Stored XSS vs Reflected XSS
What is the difference between stored and reflected XSS? - Cyber Security - Discussion Forum | Board Infinity
What is the difference between stored xss and reflected xss? - Stack Overflow
Self XSS vs Reflected XSS
Videos
Stored XSS: The malicious script is stored on the webserver.
Reflected XSS: The malicious script is reflected off the webserver.
But the above doesn't help me. Can you please explain it to me (reflected, in specific) ?
Stored XSS means that some persistant data (typically stored in a database) are not sanitized in a page, which implies that everyone can be affected by the vulnerability. For example, imagine a forum where users' answers posted are not escaped. If someone posts a topic with some HTML on it, everyone that goes to the topic page will be affected! The risks can generally be important, since it affects all users and can widespread rapidly (a typical example is Myspace XSS worm which impacted one million users in 20 hours).
Reflected XSS, on the contrary, means that non-persistent data (generally data provided by the client through form submission) are not escaped. For instance, imagine a search engine where in the results list page, your search keywords are redisplayed (and not sanitized). You could then put html on your research and it will be executed. While the risks of this vulnerability are less obvious, since it only affects the user who made the injection, it can be a problem too. For example if a malicious user sends a link with the injection on it to a victim, and the victim clicks on the link.
With perspective of business impact on system
Stored XSS is persisted into the system and hence is visible to anyone else who comes and reads the content stored. For example, if I edit a page in wikipedia and inject some javascript code, that will be visible to all new visitors.
Reflected XSS on other hand is like I input some code, which is reflected back to me alone. This one will not be in general visible to others, however such a vulnerability can be utilized by hacker for clickjacking. Suppose an url parameter for a search results page can be converted to a code script. This url can be send people over emails and they would click on it to see the malicious code executed on our business site. Though no such code existed in our site, lack of input validation will result in such urls to show malicious content on our site as if it were there and business owner will lose their brand reputation.
Reflected XSS occurs when user input included in the url address is reflected in the page source un-unescape .
Now, a lot of things can be user input such as your input in search form , the url adress itself . an example is
https://vulnerable.com/<script>alert(1)</script>
lets say after visiting the url and you check the page source in your browser and you see <script>alert(1)</script> somewhere in the page source . This is a reflected xss and can be used to exploit other users since anyone who visited that link will have the xss fired and their cookies stolen if lacking the httponly flag
Self XSS self Xss is an xss that executes in the context of the user who submits the payload . Say web app has profile function and in the profile function you have an option to specify a nickname . now in this web app you cant view other user profiles , meaning thier is no way to make another user view your profile . Most bank apps are like this. Now, if the nick name parameter is vulnerable to xss , The xss here would be self xss because only you can view your user profile and the xss will only execute in your own context . You can agree that stealing your own cookies isnt of any impact
Reflected XSS vulnerabilities typically refer to links that you can trick people into clicking - if the user follows them then the javascript is executed, eg https://www.example.com/example?search=<script>alert(1);</script>
Self XSS vulnerabilities typically require the user to type something in, such as putting <script>alert(1);</script> in a form field where the value is not populated from a URL or form parameter. So you can only impact yourself with self XSS vulnerabilities unless you have a really gullible user :)