XSS - Reflected XSS

Reflected XSS xảy ra khi một website có chức năng search và filter với URL như sau: https://insecure-website.com/search?term=gift. Nếu website dính Reflected XSS, attacker có thể lợi dụng để tấn công bằng cách truyền vào term parameter dạng: https://insecure-website.com/search?term=<script>alert("Hehe website is hacked")</script>.

HTML Context Labs

• Reflected XSS with nothing encoded
• Reflected XSS with most tags and attributes blocked
• Reflected XSS with all tags blocked except custom ones
• Reflected XSS with event handlers and href blocked
• Reflected XSS with some SVG markup allowed
• Reflected XSS with angle brackets HTML-encoded
• Reflected XSS in canonical link tag

JavaScript Context Labs

• Reflected XSS with single quote and backslash escaped
• Reflected XSS with angle brackets encoded
• Reflected XSS with all encoded and escaped

Tổng quan

Reflected XSS techniques bao gồm:

• Bypass HTML encoding
• Bypass tag/attribute filtering
• Sử dụng custom tags và SVG
• Escape từ JavaScript context
• Trigger qua event handlers