# Reflected XSS on the data.gov (WAF bypass+ Chrome XSS Auditor bypass+ works in all browsers)

Reflected XSS in data.gov pagination via crafted query string that bypassed Kona WAF and Chrome XSS Auditor, firing on hover across all browsers.

- Payout: hidden
- Severity: medium
- Program: GSA Bounty
- Found by: sp1d3rs
- Disclosed: 2017-09-15
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/265528
- Library page: https://bugbountylibrary.com/r/h1%3A265528
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:chained technique:source-review vuln:xss

**Target:** web pagination endpoint (/local/) query parameters
**Root cause:** Pagination block reflects unsanitized query-string input into an attribute/event context; FILTER_SANITIZE_STRING strips characters that the WAF relies on, so the two defenses neutralize each other and the mangled payload still executes.
**Steps:**
1. Craft URL with extra `&` chars and encoded payload: `https://www.data.gov/local/?&q&zzz%27onmou%3Cseover=1&ale%3Crt(%27xsp%27%3C)%3C;1;%20//`
2. Open in Firefox, Chrome or IE
3. Hover the mouse over Page 2 in the pagination block
4. Payload executes as reflected XSS
**How found:** Trial-and-error with `&` characters in specific positions; noticed input appeared sanitized without them, and that the stripping function removed chars the WAF depended on, letting the payload slip past both defenses.
**Exploitation:** Attacker sends crafted link; victim hovers pagination Page 2, triggering the injected event handler in all browsers.
**Escalation:** Site-wide: same pagination pattern affected 80+ endpoints.
**Insight:** When a sanitizer strips characters, test whether the stripped chars are exactly what a WAF signature matches on—mangling input can defeat both layers simultaneously; also probe pagination blocks for reflected query params.