https://blog.mingon.dev/tags/reflected-xss/Recent content in Reflected XSS on 보안 연구 노트Hugo -- gohugo.ioko-KRMon, 08 Jun 2026 17:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-protected-by-csp-with-csp-bypass/Mon, 08 Jun 2026 17:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-protected-by-csp-with-csp-bypass/CSP report-uri의 token 파라미터에 script-src-elem 지시어를 주입해 인라인 script 실행을 허용하는 CSP 우회 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-protected-by-very-strict-csp-with-dangling-markup-attack/Mon, 08 Jun 2026 13:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-protected-by-very-strict-csp-with-dangling-markup-attack/외부 리소스를 제한하는 엄격한 CSP에서 누락된 form-action을 이용해 폼 제출 목적지를 바꾸고 CSRF 토큰을 획득하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-in-a-javascript-url-with-some-characters-blocked/Mon, 08 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-in-a-javascript-url-with-some-characters-blocked/괄호와 공백이 차단된 JavaScript URL에서 화살표 함수, 전역 onerror, 강제 문자열 변환을 조합해 alert(1337)을 실행하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-event-handlers-and-href-attributes-blocked/Sun, 07 Jun 2026 17:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-event-handlers-and-href-attributes-blocked/이벤트 핸들러와 href 속성이 차단된 환경에서 SVG animate로 링크의 href를 동적으로 javascript URL로 바꾸는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-angularjs-sandbox-escape-and-csp/Sun, 07 Jun 2026 13:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-angularjs-sandbox-escape-and-csp/엄격한 CSP가 적용된 AngularJS 1.4.4 환경에서 ng-focus와 orderBy 표현식 가젯으로 샌드박스를 탈출하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-angularjs-sandbox-escape-without-strings/Sun, 07 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-angularjs-sandbox-escape-without-strings/문자열과 $eval을 사용할 수 없는 AngularJS 1.4.4 환경에서 String 프로토타입과 orderBy 필터로 샌드박스를 탈출하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-template-literal-with-angle-brackets-single-double-quotes-backslash-and-backticks-unicode-escaped/Sat, 06 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-template-literal-with-angle-brackets-single-double-quotes-backslash-and-backticks-unicode-escaped/여러 구분 문자가 인코딩된 JavaScript 템플릿 리터럴에서 ${} 표현식을 이용해 코드를 실행하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-angle-brackets-and-double-quotes-html-encoded-and-single-quotes-escaped/Fri, 05 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-angle-brackets-and-double-quotes-html-encoded-and-single-quotes-escaped/작은따옴표 앞에 추가되는 역슬래시를 공격자가 입력한 역슬래시로 상쇄해 JavaScript 문자열을 탈출하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-single-quote-and-backslash-escaped/Fri, 05 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-single-quote-and-backslash-escaped/작은따옴표와 역슬래시가 이스케이프되는 JavaScript 문자열에서 HTML 파서의 script 종료 규칙을 이용하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-in-canonical-link-tag/Fri, 05 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-in-canonical-link-tag/현재 URL이 canonical link의 작은따옴표 속성에 반사되는 지점에 accesskey와 onclick을 주입하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-some-svg-markup-allowed/Thu, 04 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-some-svg-markup-allowed/일반적인 태그와 이벤트를 차단하는 WAF에서 허용된 SVG animateTransform 요소와 onbegin 이벤트를 찾는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-all-tags-blocked-except-custom-ones/Thu, 04 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-all-tags-blocked-except-custom-ones/표준 HTML 태그가 모두 차단된 환경에서 포커스 가능한 커스텀 요소와 URL fragment를 이용하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-most-tags-and-attributes-blocked/Thu, 04 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-most-tags-and-attributes-blocked/WAF가 허용하는 body 태그와 onresize 이벤트를 열거하고 iframe 크기 변경으로 자동 실행하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-dom-xss/Wed, 03 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-dom-xss/서버가 JSON에 반사한 검색어를 클라이언트가 eval로 처리하는 흐름에서 역슬래시 이스케이프 누락을 이용하는 Reflected DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-angle-brackets-html-encoded/Wed, 03 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-angle-brackets-html-encoded/꺾쇠가 인코딩되지만 입력값이 JavaScript 문자열에 반사되는 환경에서 작은따옴표로 문자열을 탈출하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-attribute-with-angle-brackets-html-encoded/Tue, 02 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-attribute-with-angle-brackets-html-encoded/꺾쇠가 HTML 인코딩되는 환경에서 input의 value 속성을 탈출하고 autofocus와 onfocus를 주입하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-nothing-encoded/Mon, 01 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-nothing-encoded/검색어가 인코딩 없이 HTML 본문에 반사되는 지점에 script 태그를 삽입해 JavaScript를 실행하는 기본 Reflected XSS 풀이