What is Reflected XSS?

  • Fed up with the following definition.

    Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other web site. When a user is tricked into clicking on a malicious link, submitting a specially crafted form, or even just browsing to a malicious site, the injected code travels to the vulnerable web site, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a "trusted" server

    Can somebody explain me with an example. And what is the main difference between Reflected XSS and Stored XSS?

    After reading the answer read back the above description everything will get cleared.

  • Greg

    Greg Correct answer

    7 years ago

    So let's say you navigate to www.example.com/page?main.html and it puts you on the main page of example.com. Now you navigate to the index, which is located at www.example.com/page?index.html. You start to wonder, what other pages are there?

    So you type in www.example.com/page?foo and hit enter, and you get an error page which will say something like "Resource foo is not found".

    The thing to note here is that you put a parameter into the URL, and that parameter got reflected back to you as the user. In this case, it was the parameter "foo".

    Now the idea behind reflected XSS should be a bit more clear; instead of inputting a lame parameter like "foo", you input something like <script>alert(1)</script>foo and hit enter. On a vulnerable site, that entire parameter will get injected into the error page that pops up, the javascript will execute, and you'll get a popup in addition to the "Resource foo is not found" message. If you can induce somebody else navigate to the same link that you crafted, you can execute arbitrary javascript in their session.

    That's a very clear explanation, kudos for the good writing!

License under CC-BY-SA with attribution

Content dated before 7/24/2021 11:53 AM