> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/xss/reflected-xss.md). # Reflected XSS ### What is reflected cross-site scripting? Reflected cross-site scripting (or XSS) arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe. These type of XSS is shown in the URL or in the request header.
{% embed url="" %} Here is some common payloads: ``` "> '>
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//\x3csVg/\x3e ``` For this type of attack, you would need to send this to a victim, whether thats an email, redirect, or other message.