69 lines
1.6 KiB
Plaintext
69 lines
1.6 KiB
Plaintext
== Reflective XSS
|
|
|
|
See the HTML file below, which passes data to a JSP file.
|
|
|
|
[source,html]
|
|
-------------------------------------------------------
|
|
<html>
|
|
<body>
|
|
<form action = "main.jsp" method = "POST">
|
|
First Name: <input type = "text" name = "first_name">
|
|
<br />
|
|
Last Name: <input type = "text" name = "last_name" />
|
|
<input type = "submit" value = "Submit" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
-------------------------------------------------------
|
|
|
|
Here is the JSP file:
|
|
|
|
[source,html]
|
|
-------------------------------------------------------
|
|
<html>
|
|
|
|
<head>
|
|
<title>Using GET and POST Method to Read Form Data</title>
|
|
</head>
|
|
|
|
<body>
|
|
<h1>Using POST Method to Read Form Data</h1>
|
|
<table>
|
|
<tbody>
|
|
<tr>
|
|
<td><b>First Name:</b></td>
|
|
<td><%= request.getParameter("first_name")%></td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Last Name:</b></td>
|
|
<td>
|
|
<%= request.getParameter("last_name")%>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</body>
|
|
|
|
</html>
|
|
-------------------------------------------------------
|
|
|
|
|
|
As you can see the JSP file prints unfiltered user input which is never a good idea.
|
|
You want people to access the page like this:
|
|
|
|
----
|
|
http://hostname.com/mywebapp/main.jsp?first_name=John&last_name=Smith
|
|
----
|
|
|
|
But what happens if someone uses this link:
|
|
----
|
|
http://hostname.com/mywebapp/main.jsp?first_name=<script>alert("XSS Test")</script>
|
|
----
|
|
|
|
=== It is your turn!
|
|
|
|
Try to prevent this kind of XSS by escaping the URL parameters in the JSP file:
|
|
|
|
|
|
|