Questions tagged [reflected-xss]
The reflected-xss tag has no usage guidance.
2
votes
2answers
564 views
What are the common features to identify XSS attack from Apache log file?
I have tried some XSS vulnerability on web application such as webgoat, OWASP mutillidae, bWAPP. I want to know the features/keywords/footprints of cross site scripting attack in apache log file and ...
0
votes
1answer
79 views
Exploit: Send cookie to another server from url
I'm testing a web application and found that url contains "redirect=" where it navigates to new location once logged in.
http://IPAddress/?redirect_uri=test
I'm trying to exploit the cookie using ...
0
votes
1answer
60 views
Reflected XSS in multiline script block
I am trying to exploit a reflected cross site scripting in a GET request where the reflection is in the first multi line script block.
It seems I can use every character but <, > and " and the ...
0
votes
1answer
126 views
How does OWASP ZAP find Reflected XSS?
What I'm doing:
I'm using OWASP Zap to find vulnerabilities in a site (I have the owner's consent) and Zap came up with a Reflected XSS Vulnerability after I did an active scan on a POST request. It ...
3
votes
1answer
93 views
Why the following XSS vectors work without closing bracket?
The following XSS injections will execute without the accompanying closing tag (see this demo):
<body/onload=alert(1)
<svg/onload=alert(1)
<iframe/onload=alert(1)
I just need to know why ...
2
votes
1answer
85 views
Are unescaped backslashes dangerous in terms of XSS?
I thought the \ (backslash) character was a dangerous character that you needed to filter out/properly encode to protect against XSS attacks (OWASP says so, too), and I still do, but why?
I found a ...
1
vote
0answers
184 views
How can I steal all cookies from reflected XSS?
I just found a website with a XSS vulnerability. When I visit the following URL, a pop up occurs:
https://example.com/article/HALLOWEEN"><script>alert(1);</script>
I have a ...
4
votes
3answers
1k views
Is this code vulnerable to Reflected XSS?
I'm doing a pentest and came by this code:
(function() {
var subdomain = (function() {
var query = /[?&]css=([^&#]*)/i.exec(window.location.search);
if(...
0
votes
2answers
92 views
XSS vulnerability through burp suite
I am getting a XSS vulnerability through burp suite but when I inject script manually I don't get the XSS vulnerability.
Is this a reportable vulnerability?
3
votes
1answer
59 views
What are some ways to execute a reflected XSS attach
I was wondering how many different methods exist for executing XSS attacks.
In just about every demonstration I see, the attack is triggered in one of the below 3 ways:
By entering the script into ...
0
votes
0answers
30 views
Reflected XSS testing [duplicate]
If there is no input on a HTML page.
How to test for Reflected XSS?
If a param reflects "hello" on a HTML page.
And if then I request ">hello
and the site encodes "> to %22%3E not hello, is ...
-1
votes
1answer
129 views
Xss filtering of single quote [closed]
Any hint Here
Bypass filtering of single quote
http://leettime.net/xsslab1/stage--08.php
0
votes
2answers
1k views
XSS with URL encoding
If a website URL gets encoded then is the website still vulnerable to XSS or no?
For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
1
vote
2answers
205 views
Why is unsanitized output from ajax request bad?
I know what I just described is a reflected XSS vulnerability. What I can't figure out is why it is a vulnerability. Because the way I see it, a user can't be directed to the attacker's content ...
0
votes
1answer
279 views
What is the XSS auditor in Chrome/Firefox and how do I find bypasses?
I've been doing a lot of bug bounties lately and although I've been gaining reputation and experience, I never seem to find XSS even in private programs. Items are always being reflected as HTML.
It ...
-1
votes
1answer
417 views
Bypass this unique XSS filter?
I found a website that reflected back the user inputs. But the problem is when I inject this payload <svg/onload=alert(1)> I get an error.
But when I use this payload <%20svg/onload=alert(1)&...
2
votes
1answer
227 views
Why does Chromes XSS filter block injection into HTML element, but not into attribute?
I have this vulnerable code which takes a GET parameter, and puts it inside a HTML element (h1) as well as inside a HTML attribute (data-text):
$data = $_GET["payload"];
echo "<h1>" .$data. "&...
1
vote
1answer
506 views
How to bypass response Location in order to obtain content XSS?
In some basic steps:
POST Request containing a photo with multipart/form-data.
HTTP/1.1 302 Found respond with redirect back to formular
Redirect to initial formular.
In case 1 we are able to ...
-3
votes
1answer
133 views
How to ensure the third party CDN is secure (and stays secure)?
Most of the modern applications are using CDN for third party libraries. For example, let's say I use xxxv2.min.js from cdn.example.com/xxxv2.min.js
Everything is good, until the day that company has ...
3
votes
1answer
1k views
XSS in textarea when < and > are not allowed?
I am trying to perform XSS on the injection point marked with XXXX here:
<textarea name="billing[something]" id="billing-something" rows="1"
type="phone" title="something" placeholder="something" ...
-4
votes
1answer
460 views
How to bypass server side XSS filter for characters like < > / * [duplicate]
i was trying to exploit a website using XSS, but whenever I try an injection containing <, >, / or * I get the following message:
I think website is trying to protect against XSS commands using ...
1
vote
1answer
2k views
Bypassing <, > XSS filter
<img class="avatar" src="MY INPUT SPACE">
I am trying to bypass an XSS filter but it is not working since given <, > are filtered. I feel like it I could break it since only these two ...
11
votes
1answer
350 views
How to report a vulnerability in a site that wants to call the FBI?
I was browsing a site recently that looked like it had been designed in 2000. However, this site has a good Alexa rank and a fairly active online community. For the protection of the site, I will not ...
0
votes
0answers
119 views
xsser fails to find easy XSS vulnerability (Web For Pentester)
I tried to evaluate the effectivity of xsser (http://xsser.03c8.net) by letting it run against the "Web For Pentester" XSS tests (https://pentesterlab.com/exercises/web_for_pentester/course) is it ...
0
votes
0answers
131 views
XSS payload/technique where / is replaced by \/
The payload is getting reflected inside a <script> and again <b> tag but my payloads are not getting executed as the application replaces / with \/.
"ResolvedArgs":{"search":"SEARCH TERM ...
2
votes
2answers
439 views
Reflected XSS only works through Burp Repeater because of URL encoding
I am able to get reflected XSS through burp repeater using a GET request. I then click on show response in browser and I am able to get an XSS alert. But when I manually go to the URL in my browser ...
4
votes
1answer
2k views
Bypassing browsers URL encoding to do reflected XSS from query parameter?
I tried to get reflected XSS in vulnerable website with a request to the following URL:
https://vulnerable.website/dir/dir?param1=test"><svg/onload=alert(1)>
The browser URL encode the ...
-1
votes
2answers
96 views
XSS vulnerabillity in response
I'm checking for reflective XSS in a website and have noticed that the website uses the concept of HTML escaping, so basically any special/invalid characters are escaped. So injecting is not that easy....
4
votes
1answer
2k views
How to perform XSS in hidden HTML input fields using accesskey?
I am trying to insert a XSS payload into a hidden HTML input field. I know it works with a script tag like below, but I am looking for other alternatives.
<input type="hidden" name="date" value=""/...
2
votes
1answer
2k views
XSS - double quote and backslash escaping
I'm currently testing my own XSS filter and don't know if I thought everything through, so I need some advice.
Let's say my code looks like this:
<script>
var test = {src: "test", layer: {"...
0
votes
2answers
6k views
Reverse shell using XSS [closed]
If a certain web application is vastly vulnerable to XSS attacks, is it possible for the attacker to gain a reverse shell using an certain XSS payload without uploading any mallicous files to the web ...
1
vote
1answer
394 views
Impact of the response content-type on the exploitability of XSS
I've come across an API of a web application I'm testing, which reflects with unescaped, unencoded, user-controlled data for some requests. However, the response includes the header Content-Type: ...
4
votes
2answers
2k views
XSS inside anchor tag (<a>) without user interaction?
Is it possible to inject a payload inside <a> tag such that the script runs without user interaction?
The injection is inside the href attribute. I can inject onmouseover or onclick attributes, ...
0
votes
0answers
74 views
How to do XSS in HTML attribute [duplicate]
The following is the scenario:
My input is going in a value attribute.
Special chars are not blocked except ., " and <.
I can inject special chars like >()/ etc.
I want to close the tag and ...
0
votes
1answer
249 views
JS bug is stopping xss payload to exeute
The XSS vector is at the * but the function issue_type is not declared hence my payload is not getting executed.
following is the instance of the vulnerable code:-
<select name="sub_subissues" ...
1
vote
2answers
290 views
Is all reflected XSS bad?
I stumbled on a site today that was vulnerable to XSS. I was able to get an alert box to display via an input box and some JavaScript. I was about to report this to the site owner, but I realized ...
33
votes
8answers
6k views
Is reflected XSS still relevant today?
I've been learning more about XSS (for the unfamiliar, Excess XSS is a great resource). I opted to get my hands dirty and give Reflected XSS a try on a local environment. I set up a very simple ...
0
votes
2answers
1k views
Why is an XSS payload in the address bar executed?
I was playing with OWASP Mutillidae II and in one page I've found a vulnerability. In the address bar I've wrote something like this:
127.0.0.1/.../?page=text-file-viewer.php/"><script>...
