What is Reflected XSS?
Reflected Cross-Site Scripting (XSS) is a client-side injection vulnerability that occurs when user-supplied data is immediately included in the response from a web server, without proper sanitization or encoding. The attack payload is typically embedded in a URL and reflected back in the server's response, often in error messages, search results, or login pages.
🎯 Key Concepts
- Trigger Point: Occurs when data is reflected from the request to the response.
- No Persistence: Unlike stored XSS, the payload is not saved — it's delivered via a crafted link.
- Execution: Relies on tricking a user into clicking the malicious URL.
- Impact: Can lead to session hijacking, credential theft, defacement, or redirection.
🧪 Step-by-Step Exploitation
Step 1: Identify a Reflection Point
Test parameters in the URL, such as ?q=, ?search=, ?message=. Use harmless input first:
https://example.com/search?q=testStep 2: Inject a Script Payload
If the input is echoed back unsanitized, try injecting:
https://example.com/search?q=<script>alert('XSS')</script>Step 3: Observe Execution
If the JavaScript executes (e.g. an alert box pops up), the site is vulnerable to reflected XSS.
🌍 Real-World Example
Target: https://vulnerable-site.com/login?error=
Testing payload:
https://vulnerable-site.com/login?error=<script>alert('XSS')</script>If the error message displays the unsanitized input:
Login failed: <script>alert('XSS')</script>Then the browser will execute the script, confirming the vulnerability.
💡 Practical Tips for Pentesters
- Use tools like XSStrike, Burp Suite, or XSS Hunter
- Try payloads with different encodings (URL, HTML entity)
- Inspect headers — sometimes reflection occurs in meta tags or JavaScript
- Always validate both GET and POST requests
- Report all successful injections with context and payload used
🛡️ Mitigation Techniques
- Use output encoding (e.g.,
htmlspecialchars()in PHP) - Apply Content Security Policy (CSP) headers
- Sanitize inputs using server-side libraries (OWASP ESAPI, DOMPurify)
- Validate input types (e.g., reject script tags, JavaScript URLs)
- Use frameworks with built-in XSS protection (React, Angular, etc.)