Day 1 : https://github.com/Yavuzlar/VulnLab/tree/main

Reflected Cross-Site Scripting (XSS) happens when user input is sent to the server and the server reflects that input back into the HTML response.

.The browser executes it as JavaScript

In this lab: the application directly reflected input from the q parameter into the page without sanitization or encoding.

That's the mistake.

🧠 Root Cause (Why It Happens)

The backend logic conceptually looked like this:

echo $_GET['q'];

No:

.Input validation

.Output encoding

.HTML escaping

So whatever the user sends → gets rendered → browser executes it.

The browser doesn't know it's malicious. It just sees valid HTML/JS.

🧪Lab Environment

Vulnerability: Basic Reflected XSS Severity (from report): High (CVSS 7.4)

The vulnerability occurs because:

User-controlled input from the q parameter is reflected directly into the HTML response.

💣 Proof of Concept (PoC) 🎯 Payload Used <script>alert('XSS')</script>

🔍 How to Reproduce

Navigate to the vulnerable page.

Locate the URL parameter q.

Inject the payload:

http://target-site/lab/xss/basic-reflected/?q=<script>alert('XSS')</script>

Press Enter.

💥 Result

A JavaScript alert box appears.

This confirms:

Input was reflected

Script executed in browser context

No sanitization present

That popup = JavaScript execution = vulnerability confirmed.

⚠️ Why Is This Dangerous?

Even though we used alert() for testing, a real attacker could:

🍪 Steal session cookies

🔓 Hijack accounts

🎭 Impersonate users

🧾 Modify page content

🔁 Redirect users to phishing sites

That's why this vulnerability was rated High Severity in the assessment

📊 CVSS Breakdown (From Report)

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Score: 7.4 — High

Meaning:

Network exploitable

No authentication required

Low complexity

User just needs to click a crafted link

🛡️ How To Fix It (Remediation)

✅ 1. Output Encoding (Most Important)

Always encode before rendering in HTML:

echo htmlspecialchars($_GET['q'], ENT_QUOTES, 'UTF-8');

✅ 2. Validate Input

Allow only expected characters.

✅ 3. Use Content Security Policy (CSP)

Example:

Content-Security-Policy: script-src 'self'

✅ 4. Use Security Libraries

Like:

OWASP ESAPI

DOMPurify (for frontend)

🧩 Beginner Explanation (Super Simple)

Think of it like this:

The website asked:

"What do you want to search?"

You replied:

"Run this JavaScript code."

And the website said:

"Sure 😄R&quo;

That's Reflected XSS.

The server trusted user input.

Never trust user input.

🎯 Key Takeaway — Day 1

Reflected XSS is:

Easy to find

Easy to exploit

Extremely dangerous

100% preventable Security is not about fancy hacking. It's about developers respecting user input.