Reflected XSS Sandbox
web · easy · +25 XP
// what is Reflected XSS Sandbox?
Cross-Site Scripting (XSS) lets an attacker inject JavaScript into a page that other users render in their browser. The browser trusts code that comes from the origin, so injected JS runs with the victim's session (cookies, tokens, DOM access). Reflected XSS bounces the payload off a server response; stored XSS persists in the DB and fires whenever the page is loaded; DOM XSS happens entirely in JavaScript with no server roundtrip.
// how attackers detect it
- [01]Reflect a unique marker (e.g.
hcXSS123) in every input. If you see it back in the response source view → it's reflected. - [02]Check the context: HTML body? attribute value?
<script>block? URL? Each context needs a different payload. - [03]Burp Suite → Repeater + the
xss-strikewordlist. Or runnuclei -t fuzzing-templates/xss/for breadth.
// how defenders prevent it
- ✓Context-aware output encoding — use the templating engine's auto-escape (Jinja2, React JSX, Vue v-text).
- ✓Set Content-Security-Policy
script-src 'self'; object-src 'none'to break inline-script payloads. - ✓Use
HttpOnly+SameSite=Laxcookies so JS can't read auth tokens even when XSS lands. - ✓Sanitise raw HTML with DOMPurify (not regex — never with regex).
// real-world incidents
CVE-2024-32002
GitLab — Stored XSS in Wiki
Account takeover via wiki page rendered to other users.
CVE-2023-32243
Essential Addons WP — Reflected XSS
Affected ~1M WordPress sites.
CVE-2022-39197
Cobalt Strike — XSS in license server
Pre-auth XSS on attacker C2 panel — meme-worthy.
// hands-on tips for this lab
- ›Filter strips lowercase
<scriptonly → try<ScRiPt>alert(1)</sCriPt>,<svg onload=alert(1)>,<img src=x onerror=alert(1)>. - ›Watch the
executedfield in the response — once it flips totrue, the flag is in the same payload.
was this lesson helpful?