20 votes

Is reflected XSS still relevant today?

Reflected XSS is not only by GET. It can be by POST too. And they are not prevented always by the browsers. And of course, is still relevant. A couple of definitions: https://www.owasp.org/index.php/...
OscarAkaElvis's user avatar
17 votes

Is reflected XSS still relevant today?

Yes, all forms of XSS are still relevant today. The particular attack that you tried was obvious for the browser to heuristically find, but the code generated by more subtle injections might not be. ...
dotancohen's user avatar
  • 3,736
14 votes
Accepted

XSS inside anchor tag (<a>) without user interaction?

You can force the user interaction with CSS, by making the a element an fixed positioned block element with a large size and z-index. <a style="display: block; position: fixed; top: 0; left: 0; z-...
Polynomial's user avatar
  • 135k
13 votes
Accepted

How does OWASP ZAP find Reflected XSS?

These automated checks work by putting a script tag containing a random token into every field. For example, /someRequest?foo=x&bar=y might become: GET /someRequest?foo=<script>alert("...
Polynomial's user avatar
  • 135k
11 votes
Accepted

Is this code vulnerable to Reflected XSS?

Yes, this code is vulnerable, but not to XSS. The subdomain variable's value can indeed be controlled by an attacker, but that variable is only used to set the href parameter of a CSS stylesheet; ...
Ajedi32's user avatar
  • 4,743
10 votes

How to report a vulnerability in a site that wants to call the FBI?

If you're really just trying to help out for the greater good, you can send a message anonymously using something like Guerrilla Mail over Tor. Believe there's also a Tor hidden service for/like this, ...
AJAr's user avatar
  • 2,372
10 votes
Accepted

XSS - double quote and backslash escaping

In this specific case, if I replace \ with \\ and " with \" is it possible to trick my filter? That's not sufficient, your filter is insecure. E.g., one valid XSS attack vector would be </script&...
Arminius's user avatar
  • 44.7k
7 votes
Accepted

How to ensure the third party CDN is secure (and stays secure)?

The security measures you are thinking of already exist. Take a look at this example from jQuery's CDN page: <script src="http://code.jquery.com/jquery-3.3.1.min.js" integrity="sha256-FgpCb/...
multithr3at3d's user avatar
7 votes

How to exploit XSS in POST request when parameter is going in body?

You can not craft a link that contains a POST body. So you will have to go a somewhat different route. You will need to create your own page that contains the payload: <form action="http://target....
Anders's user avatar
  • 65.5k
7 votes

What was the real reason for dropping reflected-xss directive from CSP?

I think the Mozilla link you provide has enough in it to answer your question (quotes taken out of order from the thread so I can tell a better story): Firefox could do better using a (probably ...
Mike Ounsworth's user avatar
7 votes

Is <plaintext> vulnerable to XSS

This does not look like a successful XSS attack. First, the <plaintext> element is not special in this context. It is still supported by browsers, but HTML5 is very flexible and allows you to ...
amon's user avatar
  • 1,336
6 votes

XSS inside anchor tag (<a>) without user interaction?

Yes, that's possible. The onfocus and autofocus trick does not work in tag (correct me if I'm wrong). Correct, the autofocus attribute doesn't exist for <a> tags. But instead, you can take ...
Arminius's user avatar
  • 44.7k
5 votes

Is reflected XSS still relevant today?

Reflected XSS is still relevant because not every browser implements the same filters in the same way, some times a bypass is discovered for some implementations, therefore the auditor may not block ...
Mr. E's user avatar
  • 1,964
5 votes
Accepted

Impact of the response content-type on the exploitability of XSS

My question is if the Content-Type header in the response has an impact on the exploitability of XSS and possibly other vulnerabilities? Yes, the content type makes a difference. XSS only applies to ...
Arminius's user avatar
  • 44.7k
5 votes

Is this code vulnerable to Reflected XSS?

Any ideas if this code is vulnerable and how can it be exploited? As mentioned in the comments, this code could be vulnerable to CSS injection. For example, if the URL looks like: http://some....
hft's user avatar
  • 5,021
5 votes
Accepted

Why the following XSS vectors work without closing bracket?

If you view how your code is actually delivered by the server (for example by using the "view frame source" context menu in Chrome for the white frame in jsfiddle) you can see that it is embedded in ...
Steffen Ullrich's user avatar
5 votes

Is non-executed content still considered XSS?

This is very common for automated scanning tools. They can only be so smart, and so false positives can always happen (as can false-negatives for that matter). As a result any flagged vulnerability ...
Conor Mancone's user avatar
4 votes
Accepted

How to perform XSS in hidden HTML input fields using accesskey?

After your injection, the resulting code should look like this: <input type="hidden" accesskey="X" onclick="alert(1)"> For the payload to be executed, the user needs to press the access key ...
Anders's user avatar
  • 65.5k
4 votes
Accepted

XSS vulnerability through burp suite

If you can't verify the result of an automated tool, it is not a good idea to report it's findings. Automated tools are great, but they have a problem with false positives.
Joe M's user avatar
  • 3,002
4 votes
Accepted

read etc/passwd using XSS

Cross-Site Scripting (XSS) is a client-side vulnerability. It allows you to run client-side code (mostly javascript) on the victims' browser using a vulnerable website. This means using XSS you can ...
kigibek's user avatar
  • 166
3 votes

What is the XSS auditor in Chrome/Firefox and how do I find bypasses?

It seems unlikely that all of these companies are properly sanitizing characters and after doing some research I think this could happening because of XSS auditors in Chrome/Firefox? Chrome's XSS ...
EdOverflow's user avatar
  • 1,296
3 votes
Accepted

Bypass this unique XSS filter?

Assuming the situation is: A webpage directly insert part of the URI inside its HTML content and the restriction is: Webpage returns a static error if that URI part contains <[a-zA-Z0-9] ...
Xenos's user avatar
  • 1,361
3 votes

Bypassing <, > XSS filter

The general advice (to inject an event handler in the image tag) from @MarkBuffalo in the comment is correct, but onload isn't a great choice of event handler for images. The better option is usually ...
CBHacking's user avatar
  • 47.5k
3 votes

Reverse shell using XSS

The answer is no... at least not how you're thinking of it working. XSS attacks actually happen on the client's browser. You could use an XSS to attack the site administrator. I mean, theoretically,...
mgargiullo's user avatar
3 votes

Reflected XSS only works through Burp Repeater because of URL encoding

Came across similar scenario today. Upon debugging I found that vulnerable web page was reflecting exact URL path onto the web page which was making it vulnerable to reflected XSS. Modern web browsers ...
Noman Riffat's user avatar
3 votes
Accepted

Bypassing browsers URL encoding to do reflected XSS from query parameter?

It depends on the browser you are using. Here is a blog post from Troy Hunt regarding this topic: You can try to intercept the request using tools like Burp Suite. If you intercept the request, you ...
Kevin Gomez Buquerin's user avatar
3 votes

XSS with URL encoding

The answer depends on how the page renders your payload. If the target is a HTML page and the payload still appears as <script>alert(1)</script>, an XSS will occur, assuming no CSP or ...
isopach's user avatar
  • 511
3 votes
Accepted

Are unescaped backslashes dangerous in terms of XSS?

Unescaped backslashes can be dangerous, depending on the context. Let's assume that X and Y are user-controlled (with ' and < escaped, but not \). Then, this is exploitable: <script> var ...
Arminius's user avatar
  • 44.7k
3 votes

What are the common features to identify XSS attack from Apache log file?

There are a couple of things I want to establish first before I give you general advice for spotting common characteristics of cross-site scripting (XSS) probing attempts in your logs. I am assuming ...
EdOverflow's user avatar
  • 1,296

Only top scored, non community-wiki answers of a minimum length are eligible