> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/cross-site-scripting-xss/reflected-xss.md).

# Reflected XSS

Reflected Cross-Site Scripting (Reflected XSS) occurs when user-supplied input is immediately included in the application's response without proper sanitization or output encoding.

The malicious payload is not stored by the application. Instead, it is sent in a request and reflected back in the response, where it executes in the victim's browser.

Reflected XSS is commonly found in search pages, error messages, login forms, and other features that display user input directly in the response.

***

### Vulnerable PHP Code Example

```php
<?php

$search = $_GET['search'];

echo "Search Results for: " . $search;

?>
```

***

### Code Explanation

The application retrieves the `search` parameter from the URL:

```php
$search = $_GET['search'];
```

The value is then displayed directly in the page:

```php
echo "Search Results for: " . $search;
```

Because the application does not encode or sanitize the output, any HTML or JavaScript supplied by the user becomes part of the page and is interpreted by the browser.

As a result, user-controlled content is reflected directly into the response.

***

### How to Exploit

1. Identify an input parameter that is reflected in the application's response.
2. Confirm that the submitted value appears somewhere in the page output.
3. Determine whether the application properly encodes or sanitizes the reflected content.
4. If the browser interprets the supplied content as HTML or JavaScript instead of plain text, the application is vulnerable.
5. The attacker crafts a malicious request containing the payload.
6. A victim must visit the malicious URL or submit the crafted request.
7. When the application reflects the malicious input in the response, the browser executes it within the context of the vulnerable website.

Unlike Stored XSS, the payload is not saved by the application and only executes when the victim interacts with the crafted request.