the-web-application-hackers-handbook

434 Chapter 12 n Attacking Users: Cross-Site Scripting
Reflected XSS Vulnerabilities
A very common example of XSS occurs when an application employs a dynamic
page to display error messages to users. Typically, the page takes a parameter
containing the message’s text and simply renders this text back to the user within
its response. This type of mechanism is convenient for developers, because it
allows them to invoke a customized error page from anywhere in the application
without needing to hard-code individual messages within the error page itself.
For example, consider the following URL, which returns the error message
shown in Figure 12-1:
http://mdsec.net/error/5/Error.ashx?message=Sorry%2c+an+error+occurred
Figure 12-1: A dynamically generated error message
Looking at the HTML source for the returned page, we can see that the application
simply copies the value of the message parameter in the URL and inserts
it into the error page template at the appropriate place:
Sorry, an error occurred.
This behavior of taking user-supplied input and inserting it into the HTML
of the server’s response is one of the signatures of reflected XSS vulnerabilities,
and if no filtering or sanitization is being performed, the application is certainly
vulnerable. Let’s see how.
The following URL has been crafted to replace the error message with a piece
of JavaScript that generates a pop-up dialog:
http://mdsec.net/error/5/Error.ashx?message=alert(1)
Requesting this URL generates an HTML page that contains the following
in place of the original message:
alert(1);