Difference between revisions of "Reflected XSS"

Revision as of 01:32, 2 May 2012

Reflective (reflected) XSS (Cross Site Scripting) XSS is the art (or attack vector depending on how one might look at it) of injecting code in to a web page for the purpose of social engineering usually for the purpose of getting one to run authorized code without consent or knowledge of the targeted user. This is usually done by the lack of the coder writing in features to sanitize their code from characters such as <. ?, or /s in PHP $_GET parameters which allow for the potential attacker to inject malicious code in to the page.

Reflective XSS XSS can be easily prevented by properly sanitizing user input from the above characteristics. Though speculated that reflective XSS can be used as a SSI (server side include), it has not yet been proven that this is possible. Some of the most obvious characteristics for this are mainly due to the fact that reflective XSS is usually due to poor SQL sanitazion and manipulation of SQL data rather than actual file data.

It has been argued that it is possible to turn Reflective XSS in to a SSI should you find an environment with a file-write condition, but this has not yet been tested or proven.