Overview
Hunting XSS starts with identifying input sources — the places attacker-controllable data enters an application. This lesson covers input sources for XSS hunting.
Learning objectives
- Define input sources in the XSS context.
- Identify where user-controllable input enters.
- Connect input sources to XSS hunting.
Core concept
Input sources are the points where user-controllable data enters an application — URL parameters, form fields, request body (JSON/form data), headers, cookies, path segments, and, for client-side (DOM) XSS, client-side sources like the URL fragment. XSS arises when data from such a source reaches an output context unsafely (building on the web-security XSS module). Hunting XSS begins by enumerating the input sources an application has — every place data enters is a candidate for tracing to an output sink (next lesson) where it might execute.
How it works
The researcher enumerates the application's input sources (leveraging the endpoint/parameter discovery already done): all parameters across channels, plus client-side sources (URL fragment, etc.) for DOM XSS. Each source is a candidate to trace: does data from it get reflected into a response, stored and later displayed, or passed into a client-side sink? Mapping input sources comprehensively — including less-obvious ones (headers, cookies, JSON fields) — ensures XSS hunting covers all the ways data enters, not just visible form fields. This source enumeration sets up the source→sink analysis that finds XSS.
Practical example
Hunting XSS on an in-scope application, the researcher enumerates input sources: the search query parameter, profile form fields, a JSON API body, a custom header the app reads, and the URL fragment (a client-side source). Each is a candidate to trace toward an output context. The less-obvious sources (the header, the URL fragment) are especially worth checking, as they're often overlooked. This comprehensive source map is the starting point for finding where input might reach a sink and execute.
Cybersecurity relevance
Identifying input sources comprehensively is essential to thorough XSS hunting: XSS can arise from any source whose data reaches an unsafe output context, so missing sources (headers, cookies, JSON fields, URL fragments) means missing potential XSS. It builds on parameter/endpoint discovery and sets up the source→sink model (from the web-security XSS/DOM-XSS lessons). For defenders, it underscores treating all input sources as untrusted. Comprehensive source enumeration ensures XSS hunting covers the full input surface, improving the chance of finding real, rewardable XSS.
Common mistakes
- Only checking visible form fields, missing headers, cookies, JSON fields, and URL fragments.
- Overlooking client-side sources (URL fragment) relevant to DOM XSS.
- Not leveraging prior parameter/endpoint discovery to enumerate sources.
Key takeaways
- Input sources are where user-controllable data enters (parameters, form fields, body, headers, cookies, path, and client-side sources like the URL fragment).
- XSS arises when source data reaches an output context unsafely; hunting starts by comprehensively enumerating sources, including less-obvious ones.
- Comprehensive source enumeration (building on parameter/endpoint discovery) sets up source→sink analysis and ensures XSS hunting covers the full input surface.
Check your understanding
- What are the various input sources through which data enters an application for XSS purposes?
- Why is enumerating less-obvious input sources (headers, URL fragment) important for XSS hunting?