Reflected XSS Deep Dive

Published Nov 6, 2025 • 4 min read

What is Reflected XSS?

Reflected XSS occurs when untrusted input is included in HTML output without proper encoding. Common places: search boxes, error pages, GET parameters used inside HTML attributes or scripts.

Safe example (sanitized)

Never run payloads on live systems without permission. Example of a concept (safe):

<script>/* benign */console.log('xss-test')</script>

Remediation checklist

• Context-aware encoding (HTML, attribute, JS, CSS contexts).
• Use libraries/framework auto-encoding features (e.g., template engines).
• Set strict Content Security Policy (CSP).
• Sanitize input where appropriate and enforce least privilege on cookies (HttpOnly, Secure, SameSite).

Detection tips

Automated scanners find many XSS issues; manual testing often finds edge cases (DOM-based or unusual contexts). Use Burp with carefully crafted payloads and verify in a safe environment.