Reflected XSS and NoSQL injection lab

Objective

Test one reflected input in two contexts (HTML response and a query parameter against a database), then document the different preconditions that make each finding exploitable.

Prerequisites

• A local lab app with a reflected input and a query-backed endpoint (DVWA or a training app).
• A browser with developer tools, or Burp open on the same session.
• Understanding that context (HTML, attribute, JS, query) decides which payload is even valid.

Environment

• Context 1: a reflected value echoed into HTML (appearance, not execution).
• Context 2: a query parameter merged into a backend query without strict typing.
• Keep the target local and isolated; this lab assumes a training app you control.

Steps

1. 1

   Find where the input lands

   Send a unique marker and search the raw response for it. Where it appears (between tags, inside an attribute, in a script string) decides the exploitation path.

2. 2

   Test the HTML context

   Confirm the reflection site, then reason about encoding: whether <, >, quotes, and event handlers are filtered or escaped. A reflection that renders is a display issue until execution is proven.

3. 3

   Test the query context

   Probe the query-backed parameter for structural changes: does an object-shaped input change the result set? Compare against a plain string to avoid mistaking a filter for injection.

4. 4

   Write the two findings

   Document both as findings, each with its own precondition and impact. The same input producing two behaviors is two findings, not one.

How to verify

• The reflection site is identified in the raw response, not just the rendered page.
• Each finding states the context and the precondition under which it is exploitable.
• The query-context test compares against a control input to rule out a plain filter.