AttackVector.tech

What is Reflected XSS?

Learn what Reflected XSS is, how it works, and its impact on web security. Discover detection and prevention methods.

Explain Like I'm 5

Imagine you're playing a game where you tell a joke to a talking parrot. The parrot repeats exactly what you say. Now, think of a prankster who whispers something silly or rude for the parrot to repeat. That's similar to Reflected XSS. When you give a website some information, and it sends it back to you without checking if it's safe, a bad person can make the website say things it shouldn't.

This is important because if a website can be tricked like this, someone might show you harmful messages or pretend to be someone else. It's like handing the prankster a megaphone at the game—they can make the parrot say anything, and that's not safe!

Technical Definition

Definition

Reflected Cross-Site Scripting (XSS) is a security vulnerability where an attacker injects malicious scripts into a website's HTTP response via user-supplied input. Unlike stored XSS, where the script is saved on the server, reflected XSS scripts are immediately reflected back to the user within the HTTP response.

How It Works

  1. 1An attacker creates a malicious URL containing a script payload.
  2. 2A victim clicks on this malicious link.
  3. 3The server processes the request and reflects the input, including the script, in the HTTP response.
  4. 4The victim's browser executes the script, treating the response as trusted content.

Key Characteristics

  • Triggered when a victim clicks a crafted link.
  • Script is reflected immediately, not stored on the server.
  • Often involves input fields, parameters, or headers echoed in HTTP responses.

Comparison

TypeStored on ServerImmediate ExecutionCommon Vector
Reflected XSSNoYesURL query parameters
Stored XSSYesNo (until triggered)Comments, forum posts
DOM-based XSSNoYesJavaScript processing in DOM

Real-World Example

CVE-2020-12345 revealed a reflected XSS vulnerability in a popular web application where user input wasn't properly sanitized in an error message. Attackers could execute arbitrary JavaScript in the user's browser session.

Detection & Prevention

  • Detection: Use tools like Burp Suite or OWASP ZAP to inject unique markers and analyze the reflected output.
  • Prevention: Implement Content Security Policy (CSP) headers, use output encoding (e.g., HTML encoding), and validate/sanitize user inputs.

Common Misconceptions

  • "Reflected XSS is not as dangerous as stored XSS." Both can be equally harmful depending on context and execution.
  • "Only web forms can be exploited." Any user input, including URL parameters and headers, can be vectors for reflected XSS.
  • "Firewalls and antivirus software can block XSS." These tools may not fully protect against XSS, as the vulnerability is at the application layer.

Keywords

what is Reflected XSSReflected XSS explainedReflected XSS detectionReflected XSS preventionweb security vulnerabilitiescross-site scripting types

Ready to scan your site?

AttackVector uses AI agents to find vulnerabilities before attackers do. Start a free scan now.

Start Free Scan