Scribd
Upload
21 views7 pages

CS Lab 7 PDF

LAB of CYber security

Uploaded by

paras1282096
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
21 views7 pages

CS Lab 7 PDF

LAB of CYber security

Uploaded by

paras1282096
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 7

Name : Sambhav Jain

2200291530090
CSE(AIML)-B

LAB - 7

OBJECTIVE :Cross-Site Scripting (XSS): Exploit XSS vulnerabilities in DVWA to inject


malicious scripts into web pages. Show the potential impact of XSS attacks, such as
stealing cookies or defacing websites

WHAT IS cross site scripting(XSS) ??

XSS is a technique in which attackers inject malicious scripts into a target


website and may allow them to gain access control of the website. If a website
allows users to input data like comment, username field and email address
field without controls then attacker can insert malicious code script as well.

TYPES OF XSS:

1. Reflected XSS

2. Stored XSS

3. Dom Base XSS

Reflected XSS(cross site scripting):RXSS

In this case, hacker data is not stored on the website. reflected XSS only execute on the victim
side. reflected cross-site scripting A hacker sends input script that website then reflected back to
the victim’s browser, where hacker it executed the malicious JavaScript payloads.

Let’s try cross site scripting virtual environment

Requirements:
1. Xampp or wamp

2. DVWA (Damn vulnerable web application)

3. Browser like Firefox, explorer, Cyberfox, Chrome e.t.c

DVWA low level Reflected XSS:

Payload: <script>alert(“xss”)</script>

Step 1 : enter the admin name in the bar named “whats your name “
Step 2 : enter the script <script >alert(“hacked”)</script>

2 . stored xss
Stored cross-site scripting (XSS) In this case the hacker malicious code is
stored target website and the web server. when an attacker can send malicious
JavaScript into the website and that script is executed other users’ computers
that is stored (XSS) cross-site scripting.
Step 1 :enter the name as admin

And in text box enter the above script :


This will pop up the following window

Step 2 : again enter the name admin and the script In text box

Script :<script>alert(document.cookie)</script>
This will pop up the following window :

3 .dom based xss


Dom base (XSS) cross-site scripting attack is a short-form document object
model based cross-site scripting. That is, the page itself HTTP response does
not change, An attacker may use several DOM objects to create a Cross-site
Scripting attack. The most popular objects from this perspective are
documents.URL, document.location, and document.referrer.
Step 1 : select the default language English .and after reloading the browser this
will pop up the following window .
Hence by using different cross site scripting vulnerabilities we can change
the content of websites showing up the different incorrect pop up messages
which are harmful for the devices .

You might also like