Reflected Cross-site Scripting (XSS)

[prasadlingamaiah]

Description: Reflected XSS (Non-persistent XSS). In this case, the attacker’s payload has to be a part of the request that is sent to the web server. It is then reflected back in such a way that the HTTP response includes the payload from the HTTP request. Attackers use malicious links, phishing emails, and other social engineering techniques to lure the victim into making a request to the server. The reflected XSS payload is then executed in the user’s browser.

Reflected XSS is not a persistent attack, so the attacker needs to deliver the payload to each victim. These attacks are often made using social networks.

Proof of Concept
Step1: Access the PHP-CMS login page using the. http://127.0.0.1/PHP-CMS/login.php
Step2: Navigate to all posts location using the URL: http://127.0.0.1/PHP-CMS/admin/posts.php

Step3: Now click on the viewpost http://127.0.0.1/PHP-CMS/admin/posts.php?p_id=1

Step4: Insert the with malicious javascript in the url p_id= location.
Payload: <script>alert("rxss")</script>
Step5: The XSS malicious javascript popup is rendered.

Mitigation:
Preventing cross-site scripting is trivial in some cases but can be much harder depending on the complexity of the application and the ways it handles user-controllable data.

In general, effectively preventing XSS vulnerabilities is likely to involve a combination of the following measures:
Filter input on arrival. At the point where user input is received, filter as strictly as possible based on what is expected or valid input.
Encode data on output. At the point where user-controllable data is output in HTTP responses, encode the output to prevent it from being interpreted as active content. Depending on the output context, this might require applying combinations of HTML, URL, JavaScript, and CSS encoding.
Use appropriate response headers. To prevent XSS in HTTP responses that aren't intended to contain any HTML or JavaScript, you can use the Content-Type and X-Content-Type-Options headers to ensure that browsers interpret the responses in the way you intend.
Content Security Policy. As a last line of defense, you can use Content Security Policy (CSP) to reduce the severity of any XSS vulnerabilities that still occur.