How this template works
APIs Selection
The template uses API selection filters to specify the criteria for selecting the API requests to be tested. In this case, the template filters the requests based on the HTTP method, selecting only those with the "GET" method.
Execute request
The template executes a single request by modifying a query parameter. It appends a malicious script to the value of the query parameter, which is extracted from the original request. The modified request is then sent to the target server.
Validation
The template validates the response payload of the executed request. It checks if the response contains either the string "<script>alert(document.domain)</script>" or the string "<!doctype html>". If either of these strings is found in the response, the validation is considered successful, indicating the presence of a potential XSS vulnerability.
Frequently asked questions
"The text editor in Akto is absolutely remarkable. Its user-friendly YAML format strikes the perfect balance between simplicity and power. With intuitive features like 'API selection filter', 'Execute', Validate' creating test rules becomes incredibly easy. Akto's test editor is a game-changer, enabling seamless creation of highly personalized and effective tests that could meet the needs of any modern day organization. "
Security team,
Rippling
