Injection: Reflected XSS Injection¶

Identifier: reflected_xss

Scanner Support¶

Description¶

Reflected XSS vulnerabilities occur when user input isn't properly validated and is immediately echoed back in the response, allowing malicious scripts to execute in the victim's browser when they visit a crafted URL or submit a form.

How we test: We inject XSS payloads into request parameters and analyze responses to detect if malicious scripts are reflected without proper encoding or sanitization.

Prerequisites:

• The target must accept user input in requests (query parameters, form fields, headers, or similar) and include it in the response.
• Responses must include enough content to confirm whether the payload was reflected.

References:

https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/01-Testing_for_Reflected_Cross_Site_Scripting

Configuration¶

Example¶

Example configuration:

---
security_tests:
  reflected_xss:
    skip: false

Reference¶

skip¶

Type: boolean

Skip the test if true.