Reflected XSS

Reflected XSS (Cross-Site Scripting)

What is Reflected XSS? Reflected Cross-Site Scripting (XSS) occurs when an attacker injects a malicious script into a web page that is reflected off the server without being properly sanitized, typically via URL parameters or form inputs.

How It Works: When a user clicks on a link or submits a form containing the malicious payload, the server processes the input and reflects the malicious code back in the response, which then executes in the user's browser.

Why It Matters: Reflected XSS allows attackers to execute arbitrary JavaScript in a victim’s browser, enabling actions like session hijacking, defacement, or stealing sensitive data such as login credentials.

Common Use Cases: Reflected XSS is commonly found in improperly sanitized forms, URL query parameters, or search engines, where user input is directly echoed back without sufficient filtering or escaping.

Implementing proper input validation and output encoding can help mitigate the risk of reflected XSS attacks.

This is the printer-friendly version. See the colour Reflected XSS flyer.