Questions tagged [reflected-xss]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

XSS: bypassing html entity encoding of <,>,& characters [duplicate]

I am currently testing a webapplication that is sanitizing user input by html entity encoding special characters. E.g. <script>alert(1)</script> becomes &lt;script&gt;alert(1)&...
Pascal3366's user avatar
1 vote
1 answer
443 views

XSS in document.write(location.href)

Let's say a website contains the following <script> tag and does not have a CSP blocking any execution here. <script type="text/javascript"> document.write(location.href) </...
J Heschl's user avatar
  • 113
1 vote
0 answers
114 views

Reflected XSS but no Content-Type is specified

I have found parameter that simply reflects into response body, but no Content-Type is specified by server. It doesn't use any XSS-protection mechanisms like CSP or X-XSS-Protection. However, I was ...
ksenia pi's user avatar
0 votes
1 answer
80 views

Is XSS possible in the value field of input tag?

Let's say that I have a website with the following code in it: <input type="search" id="edit-keys" name="keys" value="$query"> With $query being the ...
zohaib zafar's user avatar
0 votes
1 answer
139 views

With Response header having content-type: application/json, is it still possible to trigger XSS?

The application is responding using the user supplied request but the content type is set as application/json. Is it possible to trigger still XSS? This is a language neutral question, it can be Java,...
warrior-oo7's user avatar
1 vote
2 answers
268 views

Reflected XSS detected by Burp Suite not working

Burp Suite detected a reflected XXS, if I use the Repeater and send the request the payload shows up in the response unfiltered, but if I visit the url it gets filtered, is there a way to bypass it or ...
Samuele Giovanetti's user avatar
0 votes
1 answer
329 views

XSS bypass in url

I have a website: https://bugbounty.com/test/"injection inside js", but " is escaped with \ and I'm trying to inject </script><script>alert() but https://bugbounty.com/test/&...
Edward Akina's user avatar
0 votes
1 answer
68 views

Why do you think this code isn't firing?

I don't have a lot of knowledge about xss so im kinda confused, why this is not popping up an alert box?
fiirat's user avatar
  • 1
1 vote
1 answer
314 views

Jsoup XSS attack with URL encoded input

I'm having a Spring Web Application that exposes REST APIs. I have implemented XSS filter using Jsoup that strips the input using Safelist.NONE. The penetration testing team raised a concern where the ...
Yuval Simhon's user avatar
1 vote
1 answer
352 views

Reflected DOM XSS Portswigger Lab

I'm a total beginner and im trying to solve Portswigger Academy labs. I'm studying on XSS right now and im stuck in somewhere. Lab Details:This lab demonstrates a reflected DOM vulnerability. ...
kgngkbyrk's user avatar
0 votes
1 answer
325 views

XSS payload to Send request to server without closing tag

I was testing a website which does not have XSS in their scope. So I thought it would be a good idea to escalate XSS to a bug which is valid. I need to make a request to my server but the problem is ...
SomeoneAlt-86's user avatar
1 vote
2 answers
807 views

Difference Between Reflected XSS and Reflected-DOM XSS

What's the difference between Reflected XSS (RXSS) and Reflected-DOM XSS (RDOMXSS)? After some research, I think it can be concluded that Reflected-DOM XSS is: Similarities: The value is reflected by ...
NoPurposeInLife's user avatar
1 vote
0 answers
187 views

Need for URL encoding in XSS / CORS lab

I am doing one of Portswigger's labs on web security, specifically CORS (cross origin resource sharing). I am having trouble understanding why there is a need for URL encoding certain parts of the XSS ...
Voyyce's user avatar
  • 11
0 votes
1 answer
201 views

Is it possible to get xss in json body request?

I was doing a VAPT assessment in which I see some JSON body in the request which has orgid deviceid So there any possibility to get XSS in json body?
B3ingN00b's user avatar
0 votes
2 answers
378 views

Parameter vulnerable for HTML injection but cannot exploit because of URL encoding

I found a HTML injection vulnerability but there is an issue. The following request returns the following: curl "https://redacted.com/xss/para?meter="><h1>Test\</h1>"<...
Ugroon's user avatar
  • 11
0 votes
1 answer
384 views

portswigger Lab - Reflected XSS into HTML context with most tags and attributes blocked

I am busy with the portswigger lab studies, doing "Reflected XSS into HTML context with most tags and attributes blocked". I successfully fire the print() on myself and the simulated victim, ...
Juan's user avatar
  • 1
1 vote
1 answer
699 views

XSS - Anyway to bypass double quotes in href of anchor?

I have an anchor that has href attribute populated by my input. I am trying to input javascript, but it always renders it useless since it always appears between double quotes. So far, I have tried ...
PradyumanDixit's user avatar
0 votes
1 answer
386 views

How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?

I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the ...
HunterTheox24's user avatar
2 votes
1 answer
1k views

Is <plaintext> vulnerable to XSS

I have a question regarding the element. I know that this element has been deprecated for a long time, but during a penetration test, we inserted the following attack vector into a textarea: <...
ItFreak's user avatar
  • 129
0 votes
0 answers
88 views

Prevent XXS through file using WAF?

I encounter a scenario which the attacker create a .jpg file containing javascript code and after uploading, the script will be executed on the browser while the .jpg file is displaying. I configured ...
Mehran's user avatar
  • 11
0 votes
2 answers
7k views

read etc/passwd using XSS

by trying the XSS room on THM, I try was trying to read the /etc/passwd using the following cmd: <iframe src="/etc/passwd"></iframe> However what I got is an error code as shown ...
user1998844's user avatar
0 votes
3 answers
140 views

Unclear security impact of a Reflected XSS vulnerability

What is the security impact of a Reflected XSS vulnerability on a state website involved in financial relations? There are no user profiles on this page and it serves as an information board and a ...
martink's user avatar
0 votes
0 answers
369 views

XSS attack being blocked by the browser

I'm trying to validate / test and XSS attack; however when I navigate to the page, the browser (tried on Chrome and Edge) tells me: A parser-blocking, cross site (i.e. different eTLD+1) script, is ...
stannage's user avatar
2 votes
2 answers
3k views

Does escaping quotes in a HTML attribute context prevent XSS?

I'm learning about XSS and I found I can inject code in this tag a few days ago. Tag: <div id="pagenotfound" title='Cannot find /it/search/testtesttesttetst\'onload=alert(1)'> My ...
CR00D3X's user avatar
  • 21
1 vote
1 answer
267 views

Blocking reflected XSS on common web servers

How is it possible to block reflected XSS on common web servers, such as IIS, Apache HTTP Server and Nginx? The Content-Security-Policy: reflected-xss filter doesn't work on latest Chrome and X-XSS-...
jwalker's user avatar
  • 33
3 votes
2 answers
398 views

Further exploit self XSS

I´m pentesting a clients website and found a self XSS Vulnerability in the Login Page: in case of a login error the Error Page shows the Username, so if you input <script>alert("XSS")&...
Opera of the Phantom's user avatar
3 votes
1 answer
1k views

Is an XSS via Cross-Site File Upload (CSFU) practically exploitable?

I came across a very interesting case: The user uploads a file The file contains <script>alert(2)</script> The web app shows the file's content to the user -> the XSS payload is ...
Cob013's user avatar
  • 133
0 votes
2 answers
181 views

can i execute javascript in href when i have text before my input?

This is where I took this example from: <a href="<?php echo $_GET['e'];?>">Back</a> In this code, I can do http://my_url?e=javascript:alert() But what can I do if my code ...
eyal's user avatar
  • 73
1 vote
0 answers
1k views

XSS with Template Literals

I suspect I have a potential XSS vulnerability at a client-side level, however, I'm not able to exploit it successfully. The URL I'm using consists of three parameters that reflect back to the user ...
pentesterdude's user avatar
0 votes
1 answer
1k views

It's possible to trigger a XSS in url context without this following caracter ' : '?

I try to bypass a XSS filter to trigger a XSS in url context. But the problem this following char is blacklist ' :' The site allow the user to use some basic html balise like h1, h2, h3, p, a, u, etc ...
Fuzzme's user avatar
  • 1
1 vote
1 answer
123 views

Reflected XSS monitoring

There is a lot of information on how to avoid or detect XSS, but I couldn't find much information on how to monitor for reflected XSS. Is there a way to automatically detect reflected XSS in my ...
vybiar's user avatar
  • 11
3 votes
0 answers
523 views

Preventing open redirects / xss on a variable return url / iframe

Let's assume I have a website where I have to either redirect the user to another URL or include another URL in an iframe, that is given by a GET parameter. I cannot use HMAC when the URL is created. ...
xsrf's user avatar
  • 158
0 votes
0 answers
155 views

URL Encoding leading to invalid flag

I'm currently completing an XSS challenge in a CTF. I successfully redirect the admin cookie to my request bin, but the flag is said to be invalid. I am told this is because the flag string gets ...
Plonker's user avatar
0 votes
1 answer
3k views

Reflected XSS in form action - understanding

I am trying to learn basics of web security vulnerabilities. I have found a website, where on reset password, you get a link in the email with a token, and when you click this link, the webpage opens ...
gaurav5430's user avatar
0 votes
1 answer
276 views

How to come out of href attribute using xss?

I was learning about XSS and found a website that takes my input say PAYLOAD and converts it to <a href = "example.com/search/PAYLOAD" > Link </a> After hit and trial, I found that it ...
Aditya Pratap Singh's user avatar
0 votes
0 answers
2k views

XSS Bruteforcing results in 500 internal server error

I've been trying to trigger xss in a website with the following url https://website.com/login/error?username_or_email=xyz%40gmai.com&redirect_after_login=%2wall While trying different payloads ...
Ananda Sai A's user avatar
5 votes
3 answers
376 views

Is non-executed content still considered XSS?

I'm working through an OWASP Zap report that has flagged several URLs on the domain as being vulnerable to XSS, but the vulnerability is never output in a context that is executable by the browser. ...
Noah Heck's user avatar
  • 151
0 votes
0 answers
22 views

How to bypass filter which blocks < charachter? [duplicate]

I am practicing reflected xss .I found a page in my lab which gives back the input in response of the request.But the application is sanitizing anything which comes after a < character because of ...
wandrer's user avatar
2 votes
2 answers
5k views

How to bypass sanitization of < while exploiting an XSS vulnerability?

Whatever is to the right of < is being deleted if I don't have a following >, else everything in between < and > is being deleted. Is there a way to bypass this sanitization?
wandrer's user avatar
  • 21
4 votes
3 answers
3k views

Reflected XSS in a JavaScript URL with some characters blocked

I am new to the field of Web Security and am practising labs from Portswigger Web Security Academy. In this lab, we have to call the alert function with 1337 as the parameter. The solution given on ...
positron's user avatar
  • 165
0 votes
0 answers
770 views

Bypass XSS in script tag

<script type="text/javascript"> window.RPM = {"debug":false,"env":"user input"} </script> user input can be inputted with xss payload. Filter is doing following replaces: i) " with \" ...
Ashish Kataria's user avatar
1 vote
1 answer
4k views

Demonstrating reflected XSS with GET Parameter and URL encoding

A client is developing a website which is vulnerable to reflected XSS through a GET parameter: https://example.com/vulnerable-url?")||true)alert("XSS");</script> I would like to demonstrate ...
user1330734's user avatar
0 votes
2 answers
227 views

XSS when I can't see URL parameters

I'm new to penetration testing and I found a Reflected XSS vulnerability on the website I'm working on. But the thing is when I submit the form, the website automatically redirects me to www.website....
ChadiSt's user avatar
-1 votes
2 answers
2k views

"Reflected XSS"-like attack on chatbot AI

This is a theoretical question. I just watched a certain video in which the author apparently unmasks a chatbot AI that is likely trying to harvest data and spread influence in a cult-like manner on a ...
user avatar
6 votes
1 answer
2k views

What was the real reason for dropping reflected-xss directive from CSP?

There were two response headers which could be set by servers to instruct browsers to enable heuristics based reflected XSS detection and prevention in the past. X-XSS Protection: 1; mode=block ...
hax's user avatar
  • 3,901
0 votes
1 answer
172 views

can you have reflective xss through a POST parameter?

While testing a dummy app, I noticed that the XSS done through POST parameters was getting stored in the form (the alert('XSS') would show every time I loaded the page where I had injected the payload)...
boomselector's user avatar
0 votes
0 answers
72 views

how to bypass URL encoding on XSS [duplicate]

I typed following script on the search input on the website alert() but website converted this script into &lt;script&gt;alert()&lt;/script&gt; in HTML content, is there any possible ...
shabeeb ck's user avatar
0 votes
2 answers
195 views

Is acquiring the csrftoken alone sufficient for performing any security exploits?

I have confirmed the presence of reflected XSS vulnerability in my website and I see the csrftoken present in one of the cookies when injecting a document.cookie in javascript. We don't have the user-...
Ravi Mahankali's user avatar
3 votes
0 answers
227 views

Is it possible to exploit this cors?

I found an xss on subdomain.example.com and i verified that the domain api.example.com accepts subdomain.example.com as valid origin. Can i exploit this as cors by inserting a CORS script in subdomain....
new liyuser's user avatar
0 votes
1 answer
4k views

Bypassing htmlspecialchars() for XSS (Reflected) and using an event handler is not an option in this case

I am trying to bypass high security XSS on DVWA. So the vulnerable code(I highly doubt that is it really vulnerable?) is:- <?php if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $...
daya's user avatar
  • 177