Home/ Questions/Q 6608227
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T19:35:14+00:00

I thought the below was not working because I was attempting XSS, but I

  • 0

I thought the below was not working because I was attempting XSS, but I tried performing a local port redirect to confirm, and it still wouldn’t work. Can someone let me know if this is XSS or not, and if not, why it’s not working?

<html>
   <div id="output"></div>
   <script src="prototype.js" type="text/javascript"></script>
   <script type="text/javascript">
      function test()
      {
         this.url = "http://www.google.com"
      }

      test.prototype.run = function() 
      {
         var request = new Ajax.Request(this.url, 
            {
               method: "get",
               onSuccess: this.success.bind(this),
               onFailure: function(response) { alert("failure"); }
            });
      };

      test.prototype.success = function(response)
      {
         var debug = "this.url = " + this.url + ",<br>"
            + " response.status = " + response.status + ",<br>"
            + " response.statusText = " + response.statusText + ",<br>"
            + " response.readyState = " + response.readyState + ",<br>"
            + " response.responseText = " + response.responseText + ",<br>"
            + " response.responseXML = " + response.responseXML + ",<br>"
            + " response.responseJSON = " + response.responseJSON + ",<br>"
            + " response.headerJSON = " + response.headerJSON + ",<br>"
            + " response.request = " + response.request + ",<br>"
            + " response.transport = " + response.transport + ",<br>"
            + " response.transport.readyState = " + response.transport.readyState + ",<br>"
            + " response.transport.responseText = " + response.transport.responseText + ",<br>";
         document.getElementById("output").update(debug);
      };

      new test().run();
   </script>
</html>
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    it’s not XSS (which is a way to attack the client side of web applications), but it is simply the same origin policy being in effect here. You can’t simply request data with an Ajax request from a domain other than your own (your own meaning the one your web application was loaded from).

    Learn more about it here: http://en.wikipedia.org/wiki/Same_origin_policy

    • 0