+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Problems with exploiting a reflected XSS (/showthread.php?tid=6276458)
Problems with exploiting a reflected XSS - SIM-5186353 - Jul 29, 2024
I found that the website is vulnerable to XSS, the first time I did a test to see if it was vulnerable to xss it gave me a 200 response and showed to be vulnerable, but when I tested it again by sending this payload <img src="http://ip:port/?vulnerable=true"> (I had a nc listener running)
It shows me the 302 error, but when I run the scan again it shows me that it is vulnerable so I don't know what is failing. Even i redirect it keeps failing.
Any help??
RE: Problems with exploiting a reflected XSS - w0rd - Aug 2, 2024
Did you check:
Content Security Policies?
X-Content-Type-Options?
X-XSS-Protection?
Referrer-Policy?
Strict-Transport-Security (HSTS)?
What about cookie attributes (for session hijacking)?
Secure?
SameSite?
HttpOnly?