Reflected XSS:
Reflected XSS is the simplest variety of cross site scripting. It arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way.
Reflected XSS attacks also known as non-persistent attacks, When a malicious script is reflected on websites to the victim' browser.
Reflected XSS Script activated through a link which sends a request to a websites with a vulnerability that enables execution of malicious ceripts.
Reflected XSS attack Example
Reflected attacks only require that the malicious script be embedded into a link.
That being said in order for the attack to be successful,the user needs to click on the infected link.
while visiting a forum site that requires users to log in to their account a perpetrtor executes this
search query:
<script type=’text/javascript’>alert(‘xss’);</script>
1) ('XSS'):The Query produces an alert box saying.
2) <script type=’text/javascript’>alert(‘xss’);</script>: The Websites page Displays
3) https://.............................?q=<script type=’text/javascript’>alert(‘xss’);</script>: The websites pages URL reads
Reflected XSS Attack
Search Query
Normal Url
URL: https://................................?search=.......
Script Url
URL: https://................................?search=<script type=’text/javascript’>alert(‘xss’);</script>
Error Message
Normal Url
URL: https://................................?message=.......
Script Url
URL: https://........../error/5/Error.ashx?message=<script>alert("XSS by Hacker1")</script>
Finding And Testing Reflected XSS vulnerabilities
The cross-site scripting vulnerabilities can be found quickly.
1)Test Every Entry Point: Test separately every entry point for data within the application's HTTP requests. This includes parameters or other data within the URL query string and message body, and the URL file path. It also includes HTTP headers, although XSS-like behavior that can only be triggered via certain HTTP headers may not be exploitable in practice.
2)Submit Random Alphanumeric Values: For each entry point submit a unique random value and determine whether the value is reflected in the response. The value should be designed to survive most input validation, so needs to be fairly short and contain only alphanumeric characters. But it needs to be long enough to make accidental matches within the response highly unlikely. A random alphanumeric value of around 8 characters is normally ideal.
3)Determine The Reflection Context. For each location within the response where the random value is reflected, determine its context. This might be in text between HTML tags, within a tag attribute which might be quoted, within a JavaScript string, etc.
4)Test Alternative Payloads: If the candidate XSS payload was modified by the application, or blocked altogether, then you will need to test alternative payloads and techniques that might deliver a working XSS attack based on the context of the reflection and the type of input validation that is being performed.
5)Test The Attack In Browser: It is best to execute some simple JavaScript like alert(document.domain) which will trigger a visible popup within the browser if the attack succeeds.
