Discovering a Reflected XSS Vulnerability in an Shopping Website

I recently discovered a reflected Cross-Site Scripting (XSS) vulnerability in the website of a company. This blog post will walk you through the discovery process, the technical details of the vulnerability, and the steps taken to report and mitigate the issue.

*Disclaimer: U are seeing this because u are either a ethical hacker or learning to become one..so just do things according to how u feel..good luck**

Reflected XSS occurs when a web application takes user input and immediately includes it in the output without proper validation or escaping. This type of vulnerability allows attackers to inject malicious scripts into web pages, which can be executed by unsuspecting users, potentially leading to session hijacking, data theft, or other malicious activities.

While performing a routine security assessment on the insurance company’s website, I noticed that the search functionality was not properly sanitizing user inputs. Here’s a step-by-step breakdown of how I uncovered the vulnerability:

Initial Reconnaissance: I started by mapping out the web application’s structure and identifying various user input points, such as search forms, contact forms, and query parameters in URLs.

Testing Input Fields: I used simple test scripts in various input fields to see how the application handled special characters and HTML tags. For instance, I input

“><h1>test</h1>

in the search bar and observed the response.

Inspecting the Response: Upon submitting the test input, I noticed that the search results page displayed the input text without proper encoding. This indicated that the application was directly reflecting the input back to the user, a common sign of reflected XSS.

Here’s a closer look at the technical aspects of the vulnerability:

Vulnerable Parameter: The search query parameter cname was found to be vulnerable.The payload

</tiTLe><d3v%0DoNPOINtereNtER+=+(prompt)``>v3dm0s

was injected into the search parameter, resulting in the following URL:

https://www.REDACTED.com/products.aspx?cname=

Server Response: The server response included the injected script without proper escaping or validation, causing the script to execute in the user’s browser.

If left unpatched, this vulnerability could allow attackers to execute arbitrary scripts in the context of a user’s session. Potential impacts include:

Session Hijacking: Attackers could steal session cookies and impersonate users.Phishing Attacks: Malicious scripts could be used to redirect users to phishing sites.Data Theft: Sensitive user information could be extracted and sent to an attacker-controlled server.

Upon confirming the vulnerability, I promptly contacted the company’s security team with detailed findings, including steps to reproduce the issue and suggested remediation measures. The team acknowledged the report and took immediate action to fix the vulnerability.

The following steps were recommended to mitigate the issue:

Input Validation: Implement strict input validation to ensure only expected data is accepted.Output Encoding: Encode user inputs before reflecting them in the web page to prevent script execution.Security Headers: Enable security headers like Content Security Policy (CSP) to provide an additional layer of defense against XSS attacks.

Finding and reporting security vulnerabilities is crucial in the ongoing effort to make the web a safer place. By responsibly disclosing this XSS vulnerability, I contributed to protecting the sensitive information of the insurance company’s customers.