The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Finding and Exploiting Reflected XSS Vulnerabilities

The most reliable approach to detecting reflected XSS vulnerabilities begins in

a similar way to the basic approach described previously. 

402

Chapter 12 

■

Attacking Other Users

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 402

---

HACK STEPS

■

Choose a unique arbitrary string which does not appear anywhere within

the application and which contains only alphabetical characters and so is

unlikely to be affected by any XSS-specific filters. For example:

myxsstestdmqlwp

■

Submit this string as every parameter to every page, targeting only one

parameter at a time.

■

Monitor the application’s responses for any appearance of this same