• caglararli@hotmail.com
  • 05386281520

How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?

Çağlar Arlı      -    14 Views

How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?

I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the following scenarios where there's no direct user input. So I have the following questions with examples. The java variable, testVarFromJava, is retrieved from backend code that do not rely on user input directly.

Questions:

  1. How to test on encoded title of webpage?

    <title> <%= Encode.forHtml("testVarFromJava")> </title>

  2. How to test on encoded java script variable?

       var testVar = '<%= Encode.forJavaScript(testVarFromJava)>';
       if (testVar == "Y") { 
          alert("testVar is Y"); 
       }
    
    
  3. How to test on encoded component in url path?

    <frame src="testApp/main.jsp?param=<%=Encode.forUriComponent(testVarFromJava)%>">