Questions tagged [reflected-xss]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
2answers
9k views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
2
votes
1answer
4k views

XSS - double quote and backslash escaping

I'm currently testing my own XSS filter and don't know if I thought everything through, so I need some advice. Let's say my code looks like this: <script> var test = {src: "test", layer: {"...
1
vote
2answers
377 views

Is all reflected XSS bad?

I stumbled on a site today that was vulnerable to XSS. I was able to get an alert box to display via an input box and some JavaScript. I was about to report this to the site owner, but I realized ...
4
votes
1answer
4k views

How to perform XSS in hidden HTML input fields using accesskey?

I am trying to insert a XSS payload into a hidden HTML input field. I know it works with a script tag like below, but I am looking for other alternatives. <input type="hidden" name="date" value=""/...
0
votes
1answer
1k views

What is the XSS auditor in Chrome/Firefox and how do I find bypasses?

I've been doing a lot of bug bounties lately and although I've been gaining reputation and experience, I never seem to find XSS even in private programs. Items are always being reflected as HTML. It ...