Reflected Cross-Site Scripting (XSS)

What Is Broken and Why

Reflected XSS occurs when an application takes user-supplied data (URL parameters, form fields, HTTP headers) and includes it in the HTTP response without proper output encoding. The browser interprets the injected content as executable script, running in the context of the vulnerable origin. Because the payload travels in the request, the attacker must socially-engineer the victim into clicking a crafted link. The root cause is missing context-aware output encoding.

Key Signals

• Input parameter value appears verbatim in the HTML response source
• Special characters <, >, ", ', & are not HTML-encoded in responses
• JavaScript context: input reflected inside <script> blocks or event handlers without escaping ', ", \
• Error messages or page titles echoing raw query strings
• HTTP headers (User-Agent, Referer) reflected in error pages