Cobalt Vulnerability Wiki
Cobalt Vulnerability Wiki
Categories
V2 - AuthenticationV3 - Session ManagementV4 - Access ControlV5 - Validation/Sanitization Blind SQL injectionClickjackingCommand Injection Cookie-Based XSS Cross Site Script Inclusion (XSSI)CSRF/URL-Based XSS CSS injectionCSV Injection DOM-Based XSSFlash-Based XSS HTML injection HTTP Parameter Pollution to XSS HTTP Request Smuggling HTTP Response Splitting (CRLF)iframe InjectionLDAP injection Local File InclusionOOB (Out of Band) XXEOpen Redirect Reflected File Download (RFD) Reflected Self-XSSReflected XSS Reflected XSS - WAF bypassRemote Code ExecutionRemote File InclusionRosetta FlashServer Side Template InjectionServer Side Template Injection (SSTI) in Flask SQL Injection SSI InjectionSSRF Stored XSSTabnabbing TRACE Method XSS - Cross-Site Tracing (XST) Universal (UXSS) XSS WAF Bypass XSS via RefererXXE
V6 - CryptographyV7 - Error LoggingV8 - Data ProtectionV9 - CommunicationsV10 - Malicious CodeV11 - Business LogicV12 - Files ResourcesV13 - APIV14 - ConfigV5 - Validation/Sanitization
Reflected XSS
POC
- Change input areas with a JS payload (an example: <svg/onload=alert(1)> )
- Observe that pop-up is reflected the message 1 in the page
- Note: This is a broad concept, above payload is just an example
Impact
Low-Medium
Likelihood
Low-Medium
Ready to get started?
Join some of these great clients we're proud to have helped