> For the complete documentation index, see [llms.txt](https://jorgectf.gitbook.io/awae-oswe-preparation-resources/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jorgectf.gitbook.io/awae-oswe-preparation-resources/by-vulnerability/xss.md).
# XSS
## Reflected
### Vulnerable code
```php
Searched string: ' . $_GET['search'] . '
';
?>
```
#### The injection
`http(s)://HOST/file.php?search=1`
#### Response
```markup
```
`http(s)://HOST/file.php?search=`
#### Response
```markup
```
As you can see, the injected code gets inserted into the HTML response of the website.
`` -> Closing current tag.\
`` -> Closing javascript tag.\
`` -> Reopening `p` tag for the response not to mess up.
## Stored
In this injection, the code gets **stored** into a database (e.g. as a comment, name, description, etc) and then gets reflected when it is displayed.
## Data exfiltration
To **exfiltrate** data, a receiving server would be needed, like a HTPP server.
{% embed url="" %}
NGROK's substitute for tunXs and python's SimpleHTTPSever/http.server
{% endembed %}
### Exfiltrating basic data
```markup
```
### Exfiltrating other endpoint's data
```markup
```
## Session Hijaking
In a nuthshell, stealing the (administrator|authenticated user) sesion cookie's value and using it.
### Exfiltrating the cookie
```markup
```
### Using the cookie
```python
import requests
url = ""
exfiltrated_cookie = ""
cookies = {'PHPSESSID': f"{exfiltrated_cookie}"} # Example
r = requests.get(url, cookies=cookies)
```
## Filter Bypass
{% embed url="" %}
{% embed url="" %}