---
id: 2328
title: "Exploiting XSS in POST requests"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/exploiting-xss-in-post-requests"
published_at: "2007-03-29T18:21:00Z"
tags: ["web-security", "xss", "portswigger", "csrf", "reflected-xss", "post-requests", "form-submission"]
phying_url: "https://phying.com/item/2328"
lang: en
---

# Exploiting XSS in POST requests

## Summary

Reflected XSS reachable only via POST is exploitable: an attacker page auto-submits a crafted form cross-domain, CSRF-style, and the payload runs inside the vulnerable application's security context.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2007-03-29T18:21:00Z
- **Original:** https://portswigger.net/blog/exploiting-xss-in-post-requests
- **Phying News:** https://phying.com/item/2328