Reflected XSS via Self-XSS + CSRF Chain

Hello, in this writeup I’m going to walk through the technique I used to achieve Reflected Cross-Site Scripting (RXSS) by chaining a Self-XSS with CSRF.

Let’s first briefly define XSS and its types before diving into the actual bug.

What is XSS?

Cross-Site Scripting (XSS) is a vulnerability that allows an attacker to inject malicious scripts into trusted web pages, causing them to execute within the victim’s browser session.

Types of XSS:

• Stored XSS: the payload is permanently stored on the server (database, comments, etc.).
• Reflected XSS: the payload is immediately reflected back in the server’s response (search results, error messages, etc.).
• DOM-Based XSS: the vulnerability exists purely in client-side JavaScript, with no server involvement required.

Now let’s get into the actual bug.

Let’s call our target example.com

Recon

I started with some basic recon:

subfinder -d example.com

Going through the results, one subdomain caught my attention: banking.example.com

Discovery

I opened it and created an account. I started by checking the profile page and testing the parameters, injecting simple HTML and XSS payloads to see what would reflect in the page source.

I found a parameter called iban that reflected my input without any sanitization.

So I crafted the following payload:

"><body onpageshow=alert(document.domain)><

Upon saving, the alert fired, as shown in the screenshot below:

At this point, it was still just a Self-XSS with zero impact on other users.

Escalation

To turn this into a real, impactful vulnerability, I inspected the request further and noticed it had no CSRF token, which gave me the idea to chain it with CSRF.

I opened the request in Burp Suite Pro:

Right click -> Engagement tools -> Generate CSRF PoC

I then hosted the PoC on GitHub Pages. Now, sending this link to a victim causes the JavaScript payload to execute within their authenticated session, effectively escalating the Self-XSS into a fully Reflected XSS.