Reflected XSS — HackXpert Labs

🬷 Reflected XSS

Your input comes straight back out in the response. Every lab here is the same contact form with a different filter in front of it, so the only thing that changes between them is what you have to get past.

44 labs and targetsfree accountlesson included

How cross-site scripting actually works — taught by The XSS Rat

What it is

XSS happens when input you control ends up in the page without being neutralised for the context it lands in. Context is the whole game: inside HTML, inside an attribute, inside a script block and inside a URL all need different escaping, and a filter built for one of them is useless in the others.

How I attack it

Find where your input is reflected, then view source and look at exactly what surrounds it.
Break out of that context first - close the attribute, close the tag, close the string - before you even think about a payload.
If the output is encoded, check whether it is encoded for the right context. HTML-encoding inside a script block stops nothing.
Stored beats reflected on impact. Ask who else loads that page, and what their session can do.