I was playing with OWASP Mutillidae II and in one page I've found a vulnerability. In the address bar I've wrote something like this:"><script>alert("test");</script>

The alert box pops up, but I don't understand why? I know what happen if I put this code in an input form, but I don't know what the address bar do! How does the address bar process the string that it gets? Why does my code work if I put it in the address bar?


2 Answers 2


The address bar doesn't do anything. It's the web application which appearently takes the URL and inserts it right into the HTML markup, leading to a cross-site scripting vulnerability.

This happens either server-side or client-side: Either the PHP script delivers the page with the URL already in it, or there's a piece of JavaScript code which injects the URL after your browser has received the HTML document.


That is the same as filling a form which has an input field named page with the following data


If you get the alert pop-up, the server is writing the user input as is.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .