Reflected XSS Example

Lab : - Google gruyere

In Reflected XSS Attack , an attacker forces the web-application to return an errorsearch result, or any other response that includes some or all of the input provided by the user as part of the request, without that data being made safe to render in the browser, and without permanently storing the user provided data.

So here lets try to force the webapplication here to through an error , which can be easily done by giving some invalid URL

URL:-http://google-gruyere.appspot.com/421953921451/invalid

This will return an error as the term invalid in the URL is not part of URL

So what an attacker does here is he adds script in the same URL.

Sample URL :-
http://google-gruyere.appspot.com/

421953921451/invalid/<script>alert("TEST");</script>

This gives the following output:-

What's the "KICK" here ???We can use this
vulnerability to  find a user's session id
like below

URL: http://google-gruyere.appspot.com/421953921451/invalid/<script>alert(document.cookie);</script>

In the second image we can see that user's cookie which is stored in system is displayed here.

Now may be not all of us must be aware of what exactly a cookie is ?? and how can it be exploited.

Cookie:-

Cookie is small information stored in text file on user’s hard drive by web server. This information is later used by web browser to retrieve information from that machine. Generally cookie contains personalized user data or information that is used to communicate between different web pages.

How stored cookie can be security threat?

Some times personal information is stored in cookie , so if a user can have access to stored cookies then he use it for his personal benefit .