When attempting to find a reflective XSS vulnerability, we start by observing parameter input behavior to see whether the data is reflected back to the user. Web proxys such as OWASP ZAP and Burp Suite can help automate the discovery process with their scanning engines:
- Navigate through the application to find potential reflected values. Usually places to probe are diagnostic pages, troubleshooting, or configuration pages that change services or daemons running on the embedded device. The following screenshot shows a potential starting point for discovering a web vulnerability:
- Proxy the HTTP request in ZAP and make a change ...
