or ."}},{"@type":"Question","name":"How do I bypass WAF filters for reflected XSS?","acceptedAnswer":{"@type":"Answer","text":"Try HTML entity encoding, Unicode escapes, base64 with eval, case variation, double URL encoding, or using event handlers instead of script tags."}},{"@type":"Question","name":"What is a good tool to test reflected XSS?","acceptedAnswer":{"@type":"Answer","text":"Burp Suite Community Edition, XSStrike, XSSer, and OWASP ZAP are excellent for automated and manual testing."}},{"@type":"Question","name":"How does Content Security Policy (CSP) prevent reflected XSS?","acceptedAnswer":{"@type":"Answer","text":"CSP restricts which scripts can execute. A policy like script-src 'self' blocks all inline scripts unless nonces or hashes are used."}},{"@type":"Question","name":"What is the best defense against reflected XSS?","acceptedAnswer":{"@type":"Answer","text":"Contextual output encoding combined with a strict CSP. Never rely on input validation alone."}},{"@type":"Question","name":"Can reflected XSS occur in HTTP headers?","acceptedAnswer":{"@type":"Answer","text":"Yes, if the server reflects a header value (e.g., User-Agent) in the response page without sanitization."}},{"@type":"Question","name":"What is the difference between URL encoding and HTML encoding?","acceptedAnswer":{"@type":"Answer","text":"URL encoding (e.g., %3Cscript%3E) is for sending data in a URL. HTML encoding (e.g., <script>) is for safe display in HTML. Using the wrong one leads to vulnerabilities."}},{"@type":"Question","name":"What is a self-XSS?","acceptedAnswer":{"@type":"Answer","text":"Self-XSS occurs when the payload only affects the attacker's own session, often because the input is reflected but not shareable. It's usually not exploitable unless combined with other flaws."}},{"@type":"Question","name":"What are event handler payloads for XSS?","acceptedAnswer":{"@type":"Answer","text":"Event handlers like onerror, onload, onfocus execute JavaScript without needing 
Loading module…