The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

string. Make a note of every parameter whose value is being copied into

the application’s response. These are not necessarily vulnerable, but

each instance identified is a candidate for further investigation, as

described in the next part of this section.

■

Note that both 

GET

and 

POST

requests need to be tested, and you should

include every parameter within both the URL query string and the mes-

sage body. While a smaller range of delivery mechanisms exists for XSS

vulnerabilities that can only be triggered via a 

POST

request, exploitation

is still possible, as previously described.

■

In addition to the standard request parameters, you should also test

every instance in which the contents of an HTTP request header is