Content ITV PRO
This is Itvedant Content department
Learn and exploit different types of XSS vulnerabilities
Business Scenario
Welcome!
Today is your first day as a Security Tester at our company. Today, we received a project from a client.
Before launching the application to the public, the client wants to ensure that it is secure against common web attacks, especially Cross-Site Scripting (XSS) vulnerabilities.
Pre-Lab Preparation
Your task is to perform a security assessment of the application by identifying and exploiting different types of XSS vulnerabilities, including Stored XSS, Reflected XSS, and DOM-Based XSS.
Topic : Common Web Vulnerabilities
1) SQL Injection concepts and examples
2) Cross Site Scripting (XSS)
3) Broken authentication vulnerabilities
4) File upload vulnerabilities
5) Session management issues
Task 1: Reflected XSS
Reflected XSS (non-persistent cross-site scripting) is a web security vulnerability where a malicious script in an HTTP request is immediately echoed back by an unsafe web application response. It requires tricking a victim into clicking a crafted link, rather than saving the code on a server.
To identify and exploit a Reflected Cross-Site Scripting (XSS) vulnerability in a vulnerable web application using the PortSwigger Web Security Academy lab.
Open the PortSwigger Web Security Academy
1
Visit the PortSwigger Web Security Academy website.
b
Sub Open your web browser.
a
Click Access the Lab to launch the vulnerable application.
d
Search for the Reflected XSS lab.
c
Explore the Application
2
Locate the Search functionality.
b
After accessing the lab, you will be redirected to the vulnerable web application.
a
Click the Search button.
d
Enter a simple word such as:
c
Hello
Identify User Input Reflection
3
Check whether the text you entered (Hello) appears on the webpage.
b
Observe the search results.
a
If the input is immediately displayed in the response, the application may be vulnerable to Reflected XSS.
c
Test for Reflected XSS
4
Replace the previous search term with the following payload:
a
<script>alert("You got hacked")</script>Click Search again.
b
<script>alert("You got hacked")</script>Click Search again.
b
Observe the Result
1
An alert box displaying:
b
If the application is vulnerable, the browser will execute the JavaScript code.
a
This confirms the presence of a Reflected Cross-Site Scripting (XSS) vulnerability
Task 2: Stored XSS
Stored XSS (Cross-Site Scripting) occurs when an application receives untrusted data, stores it in a database, and later embeds that data into a webpage unsafely. When a victim views the affected page, the injected malicious script executes automatically in their browser.
Open the Lab
1
Visit the PortSwigger Web Security Academy.
b
Open your web browser.
a
Click Access the Lab.
d
Search for the lab "Stored XSS into HTML context with nothing encoded."
c
Open a Blog Post
2
You will see:
b
Once the lab loads, click View Post for any available blog article.
a
- Existing comments
- A Leave a comment section
- Input fields for:
- Comment
- Name
- Website
Submit a Normal Comment
3
Before testing for XSS, enter a normal comment using the following details:
a
| Field | Value |
|---|---|
| Comment | Hello Everyone! |
| Name | Student |
| student@mail.com | |
| Website | https://example.com |
Click Post Comment.
b
Open a Blog Post
4
Check whether your comment appears in the Comments section.
b
Reload the page.
a
If the comment is displayed, it confirms that the application stores user input in the database.
c
Test for Stored XSS
5
Leave the Name, Email, and Website fields with valid values.
b
Replace the normal comment with a simple JavaScript payload used for educational verification that displays a browser alert when the stored comment is rendered.
a
Click Post Comment.
c
Observe the Result
6
After submitting the comment:
a
An alert dialog appears, confirming that the input was executed as code instead of being safely encoded.
b
This verifies the presence of a Stored XSS vulnerability.
c
- The application stores the comment
- When the blog page displays the stored comment, the browser executes the embedded JavaScript
Great job!
You have successfully completed your XSS Vulnerability Assessment on the BiteBox project.
In this lab, you have: Identified Reflected XSS, Identified Stored XSS, Verified JavaScript execution, Observed how malicious scripts are processed, Compared both XSS attack types, and Understood their impact on web application security.
You are now ready to move to the next stage of Web Application Security Testing.
Checkpoint
Next-Lab Preparation
Topic : Common Web Vulnerabilities
1) SQL Injection concepts and examples
2) Cross Site Scripting (XSS)
3) Broken authentication vulnerabilities
4) File upload vulnerabilities
5) Session management issues
WAPT-XSS
By Content ITV
