2024-03-16 18:44:49 +00:00
|
|
|
id: reflected-xss
|
|
|
|
|
|
|
|
|
|
info:
|
2024-06-05 07:21:31 +00:00
|
|
|
name: Reflected Cross-Site Scripting
|
2024-07-24 08:51:03 +00:00
|
|
|
author: pdteam,0xKayala,AmirHossein Raeisi
|
2024-03-16 18:44:49 +00:00
|
|
|
severity: medium
|
2024-06-07 10:04:29 +00:00
|
|
|
metadata:
|
|
|
|
|
max-request: 1
|
2024-03-23 09:32:51 +00:00
|
|
|
tags: xss,rxss,dast
|
2024-03-16 18:44:49 +00:00
|
|
|
|
|
|
|
|
variables:
|
|
|
|
|
first: "{{rand_int(10000, 99999)}}"
|
|
|
|
|
|
|
|
|
|
http:
|
2024-03-31 19:55:42 +00:00
|
|
|
- pre-condition:
|
2024-03-26 07:21:56 +00:00
|
|
|
- type: dsl
|
|
|
|
|
dsl:
|
|
|
|
|
- 'method == "GET"'
|
2024-03-16 18:44:49 +00:00
|
|
|
|
|
|
|
|
payloads:
|
|
|
|
|
reflection:
|
2024-06-14 13:37:34 +00:00
|
|
|
- "'\"><{{first}}>"
|
|
|
|
|
- "'><{{first}}>"
|
|
|
|
|
- "\"><{{first}}>"
|
2024-03-16 18:44:49 +00:00
|
|
|
|
|
|
|
|
fuzzing:
|
|
|
|
|
- part: query
|
|
|
|
|
type: postfix
|
|
|
|
|
mode: single
|
|
|
|
|
fuzz:
|
|
|
|
|
- "{{reflection}}"
|
|
|
|
|
|
2024-07-22 18:59:14 +00:00
|
|
|
- part: path
|
|
|
|
|
type: postfix
|
|
|
|
|
mode: single
|
|
|
|
|
fuzz:
|
|
|
|
|
- "{{reflection}}"
|
|
|
|
|
|
2024-03-16 18:44:49 +00:00
|
|
|
stop-at-first-match: true
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: word
|
|
|
|
|
part: body
|
|
|
|
|
words:
|
|
|
|
|
- "{{reflection}}"
|
|
|
|
|
|
|
|
|
|
- type: word
|
|
|
|
|
part: header
|
|
|
|
|
words:
|
2024-06-14 13:37:34 +00:00
|
|
|
- "text/html"
|
2024-08-14 04:19:25 +00:00
|
|
|
# digest: 490a004630440220696413c6614ef961424a2b74cbbcb1385b62bc10279e9170fe528b8dc40c23fc0220375e3a090facd6e1d59817f7caacba45f49f7fb7fd450525cfa90ae5d3882649:922c64590222798bb761d5b6d8e72950
|
