Firing Range - Reflected

This page collects reflected XSS from an array of sources and to various sinks. The sinks are distributed to cover the HTML contexts, while the sources try to cover as many of the real data sources as possible.

Unless otherwise specified, no escaped is performed on the payload.

HTML Contexts

This class of XSS simply takes a value from the parameter and echoes it back in an HTML page in a specific HTML context

Parameter - Body - The parameter is echoed within the main BODY tag.
Parameter - Head - The parameter is echoed within the HEAD tag.
Parameter - Title - The parameter is echoed within the TITLE tag.
Parameter - Body HTML comment - The parameter is echoed inside an HTML comment in the HTML BODY.
Parameter - Tag name - The parameter is used as a tag name, i.e. <%q>
Parameter - Attribute unquoted - The parameter is echoed in an HTML attribute, unquoted. i.e. <foo attribute=%q>
Parameter - Attribute single quoted - The parameter is echoed in an HTML attribute, single quoted. i.e. <foo attribute='%q'>
Parameter - Attribute double quoted - The parameter is echoed in an HTML attribute, double quoted. i.e. <foo attribute="%q">
Parameter - Attribute name - The parameter is used as an attribute name, i.e. <foo %q=irrelevant>

Error status codes:

Simple body-based reflected XSS served with an error HTTP status code.

Parameter - Body - 400 - Response in the body with a 400 status code.
Parameter - Body - 401 - Response in the body with a 401 status code.
Parameter - Body - 403 - Response in the body with a 403 status code.
Parameter - Body - 404 - Response in the body with a 404 status code.
Parameter - Body - 500 - Response in the body with a 500 status code.

Tags with special semantics:

Tags that ignore content in between the closing and the opening tag

Parameter - iFrame Attribute Value - The parameter is used as an attribute value, i.e. <iframe attribute=%q>
Parameter - iFrame srcdoc - The parameter is used as an attribute value, i.e. <iframe srcdoc=%q>. The srcdoc attribute is supposed to be used together with the sandbox and seamless attributes. If a srcdoc attribute is present within an iframe it will override content specified by the src attribute. Thereby it accepts arbitrary HTML code which will be rendered inside the iframe.
Parameter - Textarea - The parameter is echoed in a TEXTAREA tag's CDATA. In this case, no parsing of the payload is performed unless the TEXTAREA tag is closed.
Parameter - Textarea Attribute Value - The parameter is used as an attribute value, i.e. <textarea attribute=%q>
Parameter - NoScript - The parameter is echoed in a NOSCRIPT tag's CDATA. In this case, no parsing of the payload is performed unless the NOSCRIPT tag is closed.
Parameter - Style Attribute Value - The parameter is used as an attribute value, i.e. <style attribute=%q>

CSS context

XSS that can occur inside a STYLE block or inside a style="" attribute.

Parameter - CSS - The parameter is echoed as the only content of a STYLE tag positioned into the HEAD.
Parameter - CSS Value - The parameter is echoed as a color value in a STYLE tag positioned into the HEAD.
Parameter - CSS Font Name - The parameter is echoed as a font value in a STYLE tag positioned into the HEAD. Font name is particularly interesting because many sanitizers do not behave correctly when parsing it.

HTML event handler JS context

XSS that can occur inside eventhandler attribute of a HTML element.
Note that these payloads are escaped so that they break out of the handler.

Parameter - unquoted onclick - The parameter is echoed in an HTML event handler attribute, unquoted. i.e. <div onclick=%q></div>
Parameter - quoted onclick - The parameter is echoed in an HTML event handler attribute, double-quoted. i.e. <div onclick="%q"></div>
Parameter - singlequoted onclick - The parameter is echoed in an HTML event handler attribute, single-quoted. i.e. <div onclick='%q'></div>

JS context

XSS that can occur inside a SCRIPT block.

Parameter - Javascript unquoted assignment - Assigns the parameter value to an unquoted js assignment, i.e. var foo = %q;
Parameter - Javascript eval - Pipes the parameter into an eval, i.e. eval(%q);
Parameter - Javascript quoted string - Assigns the parameter value to an quoted js assignment, i.e. var foo = "%q";
Parameter - Javascript single quoted string - Assigns the parameter value to a single quoted js assignment, i.e. var foo = '%q';
Parameter - Javascript slash quoted string - Assigns the parameter value to a single slash quoted js assignment, i.e. var foo = \%q\;
Parameter - Javascript comment - Inserts the parameter into a javascript comment, i.e. /* %q */

URLs

XSS that can occur due to unsanitized URLs in various contexts.

Parameter - Script SRC double quoted - Assigns the parameter to a SCRIPT src between quotes.
URL - HREF - Assigns the parameter to an HREF property of an A tag. Requires clicking to trigger.
URL - CSS - Assigns the parameter to the SRC property of a STYLE tag in the HEAD.
URL - Script SRC - Assigns the parameter to the SRC property of a SCRIPT tag. The parameter must contain a parseable URL.
URL - Object DATA - Assigns the parameter to the DATA property of an OBJECT tag. The parameter must contain a parseable URL.
URL - Param SRC - Assigns the parameter to the SRC property of an OBJECT's PARAM tag. The parameter must contain a parseable URL.

Content sniffing

These XSS can only be triggered on (and affect) content sniffing browsers.

Parameter - JSON - Inserts the parameter inside a JSON object. Returns an HTML content type. Note that this XSS does not actually require MIME content sniffing
ContentSniffing - Inserts the parameter inside a JSON object. Returns a JSON content type.
ContentSniffing - Inserts the parameter in a plain/text page.
ContentSniffing - Callback - Uses an hidden callback parameter as a JSONP callback. The interesting bit here is that the callback parameter is not in this link, so the scanner has to guess its presence.

Escaping and filtering

XSS requiring escaping or filtering certain types of requests.

Form - This XSS, in the BODY, only triggers on a POST. The page shows the HTML FORM needed to trigger it.
Parameter - Body - Blocks SpaceDoubleQuoteSlashEquals - The parameter is echoed in the BODY tag, but any request containing space, double quotes, slash and equals is blocked.
Parameter - Attribute unquoted - Blocks DoubleQuoteSinglequote - The parameter is echoed inside an unquoted HTML attribute of a tag. Payloads containing double quotes and single quotes are blocked.
Parameter - Body - Blocks lowercase script - The parameter is echoed in the BODY tag, but any request containing a lowercase "script" is blocked.
Parameter - Body - Blocks uppercase script - The parameter is echoed in the BODY tag, but any request containing a uppercase "SCRIPT" is blocked.
Parameter - Body - Blocks any script - The parameter is echoed in the BODY tag, but any request containing any case "script" is blocked.