Questions tagged [reflected-xss]
The reflected-xss tag has no usage guidance.
66
questions
0
votes
2answers
65 views
can i execute javascript in href when i have text before my input?
This is where I took this example from:
<a href="<?php echo $_GET['e'];?>">Back</a>
In this code, I can do http://my_url?e=javascript:alert()
But what can I do if my code ...
1
vote
0answers
71 views
XSS with Template Literals
I suspect I have a potential XSS vulnerability at a client-side level, however, I'm not able to exploit it successfully.
The URL I'm using consists of three parameters that reflect back to the user ...
0
votes
1answer
95 views
It's possible to trigger a XSS in url context without this following caracter ' : '?
I try to bypass a XSS filter to trigger a XSS in url context.
But the problem this following char is blacklist ' :'
The site allow the user to use some basic html balise like h1, h2, h3, p, a, u, etc ...
1
vote
1answer
48 views
Reflected XSS monitoring
There is a lot of information on how to avoid or detect XSS, but I couldn't find much information on how to monitor for reflected XSS. Is there a way to automatically detect reflected XSS in my ...
3
votes
0answers
112 views
Preventing open redirects / xss on a variable return url / iframe
Let's assume I have a website where I have to either redirect the user to another URL or include another URL in an iframe, that is given by a GET parameter.
I cannot use HMAC when the URL is created. ...
0
votes
0answers
43 views
URL Encoding leading to invalid flag
I'm currently completing an XSS challenge in a CTF. I successfully redirect the admin cookie to my request bin, but the flag is said to be invalid.
I am told this is because the flag string gets ...
0
votes
1answer
327 views
Reflected XSS in form action - understanding
I am trying to learn basics of web security vulnerabilities.
I have found a website, where on reset password, you get a link in the email with a token, and when you click this link, the webpage opens ...
0
votes
0answers
53 views
How does this DOM xss work?
I'm doing a lab on portswigger.com, this one to be specific, https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-document-write-sink-inside-select-element
var store = (new ...
0
votes
0answers
55 views
How was this mXSS on Google Search carried out?
I was reading about bug bounties that have been reported in the past and this one caught my eye as it seemed interesting.
Mutation XSS in Google Search
According to what I could understand, this is ...
0
votes
1answer
73 views
How to come out of href attribute using xss?
I was learning about XSS and found a website that takes my input say PAYLOAD and converts it to <a href = "example.com/search/PAYLOAD" > Link </a>
After hit and trial, I found that it ...
0
votes
0answers
260 views
XSS Bruteforcing results in 500 internal server error
I've been trying to trigger xss in a website with the following url
https://website.com/login/error?username_or_email=xyz%40gmai.com&redirect_after_login=%2wall
While trying different payloads ...
4
votes
3answers
158 views
Is non-executed content still considered XSS?
I'm working through an OWASP Zap report that has flagged several URLs on the domain as being vulnerable to XSS, but the vulnerability is never output in a context that is executable by the browser. ...
0
votes
0answers
17 views
How to bypass filter which blocks < charachter? [duplicate]
I am practicing reflected xss .I found a page in my lab which gives back the input in response of the request.But the application is sanitizing anything which comes after a < character because of ...
1
vote
1answer
475 views
How to bypass sanitization of < while exploiting an XSS vulnerability?
Whatever is to the right of < is being deleted if I don't have a following >, else everything in between < and > is being deleted. Is there a way to bypass this sanitization?
3
votes
3answers
484 views
Reflected XSS in a JavaScript URL with some characters blocked
I am new to the field of Web Security and am practising labs from Portswigger Web Security Academy. In this lab, we have to call the alert function with 1337 as the parameter.
The solution given on ...
0
votes
0answers
156 views
Bypass XSS in script tag
<script type="text/javascript">
window.RPM = {"debug":false,"env":"user input"}
</script>
user input can be inputted with xss payload.
Filter is doing following replaces:
i) " with \" ...
0
votes
1answer
952 views
Demonstrating reflected XSS with GET Parameter and URL encoding
A client is developing a website which is vulnerable to reflected XSS through a GET parameter:
https://example.com/vulnerable-url?")||true)alert("XSS");</script>
I would like to demonstrate ...
0
votes
1answer
56 views
Question about XSS
I'm new to penetration testing and I found a Reflected XSS vulnerability on the website I'm working on.
But the thing is when I submit the form the website automatically redirect me to www.website....
0
votes
2answers
696 views
“Reflected XSS”-like attack on chatbot AI
This is a theoretical question. I just watched a certain video in which the author apparently unmasks a chatbot AI that is likely trying to harvest data and spread influence in a cult-like manner on a ...
5
votes
1answer
720 views
What was the real reason for dropping reflected-xss directive from CSP?
There were two response headers which could be set by servers to instruct browsers to enable heuristics based reflected XSS detection and prevention in the past.
X-XSS Protection: 1; mode=block
...
0
votes
1answer
64 views
can you have reflective xss through a POST parameter?
While testing a dummy app, I noticed that the XSS done through POST parameters was getting stored in the form (the alert('XSS') would show every time I loaded the page where I had injected the payload)...
0
votes
0answers
58 views
how to bypass URL encoding on XSS [duplicate]
I typed following script on the search input on the website alert() but website converted this script into
<script>alert()</script>
in HTML content, is there any possible ...
0
votes
2answers
130 views
Is acquiring the csrftoken alone sufficient for performing any security exploits?
I have confirmed the presence of reflected XSS vulnerability in my website and I see the csrftoken present in one of the cookies when injecting a document.cookie in javascript. We don't have the user-...
3
votes
0answers
108 views
Is it possible to exploit this cors?
I found an xss on subdomain.example.com and i verified that the domain api.example.com accepts subdomain.example.com as valid origin. Can i exploit this as cors by inserting a CORS script in subdomain....
0
votes
1answer
2k views
Bypassing htmlspecialchars() for XSS (Reflected) and using an event handler is not an option in this case
I am trying to bypass high security XSS on DVWA. So the vulnerable code(I highly doubt that is it really vulnerable?) is:-
<?php
if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $...
0
votes
0answers
203 views
Finding hidden parameters manually for XSS
I am researching about XSS and Google helped me a lot about learning like how to bypass XSS filters, POST and GET based XSS .
I am really curious to know how to find hidden parameters manually for ...
0
votes
1answer
373 views
XSS triggered but chrome didn't show popup. What exactly was going on?
Related to my previous question on XSS in canonical link.
At the beginning I turned off Chrome's XSS auditor and tried executing XSS with just onload event using following payload which did not ...
0
votes
1answer
52 views
Reflected XSS which only displays in the input [closed]
I am trying to execute an XSS in an HTTP GET request,but it just displays the input without running the script.
I checked in BurpSuite and I see it added my input to referer: url and then my input.
...
0
votes
1answer
274 views
XSS vulnerability in display message
I have a webpage in which Email is given as input. It will then display "your email is abc@xyz.com". I am then changing the email in URL to <script>alert(1)</script> and send tbe request ...
1
vote
0answers
166 views
CSS Injection without colon
I'm looking for a way to create a CSS injection proof-of-concept. I can insert the following and it gets reflected in the browser:
<style>body{background-color:red}</style>
The only ...
1
vote
2answers
3k views
What are the common features to identify XSS attack from Apache log file?
I have tried some XSS vulnerability on web application such as webgoat, OWASP mutillidae, bWAPP. I want to know the features/keywords/footprints of cross site scripting attack in apache log file and ...
0
votes
1answer
4k views
Exploit: Send cookie to another server from url
I'm testing a web application and found that url contains "redirect=" where it navigates to new location once logged in.
http://IPAddress/?redirect_uri=test
I'm trying to exploit the cookie using ...
0
votes
1answer
370 views
Reflected XSS in multiline script block
I am trying to exploit a reflected cross site scripting in a GET request where the reflection is in the first multi line script block.
It seems I can use every character but <, > and " and the ...
0
votes
1answer
2k views
How does OWASP ZAP find Reflected XSS?
What I'm doing:
I'm using OWASP Zap to find vulnerabilities in a site (I have the owner's consent) and Zap came up with a Reflected XSS Vulnerability after I did an active scan on a POST request. It ...
3
votes
1answer
217 views
Why the following XSS vectors work without closing bracket?
The following XSS injections will execute without the accompanying closing tag (see this demo):
<body/onload=alert(1)
<svg/onload=alert(1)
<iframe/onload=alert(1)
I just need to know why ...
2
votes
1answer
564 views
Are unescaped backslashes dangerous in terms of XSS?
I thought the \ (backslash) character was a dangerous character that you needed to filter out/properly encode to protect against XSS attacks (OWASP says so, too), and I still do, but why?
I found a ...
1
vote
0answers
2k views
How can I steal all cookies from reflected XSS?
I just found a website with a XSS vulnerability. When I visit the following URL, a pop up occurs:
https://example.com/article/HALLOWEEN"><script>alert(1);</script>
I have a ...
5
votes
3answers
1k views
Is this code vulnerable to Reflected XSS?
I'm doing a pentest and came by this code:
(function() {
var subdomain = (function() {
var query = /[?&]css=([^&#]*)/i.exec(window.location.search);
if(...
0
votes
2answers
238 views
XSS vulnerability through burp suite
I am getting a XSS vulnerability through burp suite but when I inject script manually I don't get the XSS vulnerability.
Is this a reportable vulnerability?
3
votes
1answer
96 views
What are some ways to execute a reflected XSS attach
I was wondering how many different methods exist for executing XSS attacks.
In just about every demonstration I see, the attack is triggered in one of the below 3 ways:
By entering the script into ...
-1
votes
1answer
344 views
Xss filtering of single quote [closed]
Any hint Here
Bypass filtering of single quote
http://leettime.net/xsslab1/stage--08.php
2
votes
2answers
18k views
XSS with URL encoding
If a website URL gets encoded then is the website still vulnerable to XSS or no?
For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
1
vote
2answers
1k views
Why is unsanitized output from ajax request bad?
I know what I just described is a reflected XSS vulnerability. What I can't figure out is why it is a vulnerability. Because the way I see it, a user can't be directed to the attacker's content ...
0
votes
1answer
1k views
What is the XSS auditor in Chrome/Firefox and how do I find bypasses?
I've been doing a lot of bug bounties lately and although I've been gaining reputation and experience, I never seem to find XSS even in private programs. Items are always being reflected as HTML.
It ...
-1
votes
1answer
774 views
Bypass this unique XSS filter?
I found a website that reflected back the user inputs. But the problem is when I inject this payload <svg/onload=alert(1)> I get an error.
But when I use this payload <%20svg/onload=alert(1)&...
2
votes
1answer
270 views
Why does Chromes XSS filter block injection into HTML element, but not into attribute?
I have this vulnerable code which takes a GET parameter, and puts it inside a HTML element (h1) as well as inside a HTML attribute (data-text):
$data = $_GET["payload"];
echo "<h1>" .$data. "&...
1
vote
1answer
2k views
How to bypass response Location in order to obtain content XSS?
In some basic steps:
POST Request containing a photo with multipart/form-data.
HTTP/1.1 302 Found respond with redirect back to formular
Redirect to initial formular.
In case 1 we are able to ...
-2
votes
1answer
365 views
How to ensure the third party CDN is secure (and stays secure)?
Most of the modern applications are using CDN for third party libraries. For example, let's say I use xxxv2.min.js from cdn.example.com/xxxv2.min.js
Everything is good, until the day that company has ...
6
votes
1answer
7k views
XSS in textarea when < and > are not allowed?
I am trying to perform XSS on the injection point marked with XXXX here:
<div>
<textarea name="billing[something]" id="billing-something" rows="1"
type="phone" title="something" ...
-4
votes
1answer
1k views
How to bypass server side XSS filter for characters like < > / * [duplicate]
i was trying to exploit a website using XSS, but whenever I try an injection containing <, >, / or * I get the following message:
I think website is trying to protect against XSS commands using ...
