Scribd
Upload
11 views1 page

KGGD 6 N 5 V

This lesson focuses on detecting, exploiting, and bypassing Cross-Site Scripting (XSS) vulnerabilities, covering reflected, stored, and DOM-based XSS. It includes practical steps for lab setup, identifying input fields, injecting payloads, and employing obfuscation techniques. Key techniques include using basic payloads, event handlers, and URL-based injections to test for vulnerabilities and bypass filters.

Uploaded by

iphoneboeken
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
11 views1 page

KGGD 6 N 5 V

This lesson focuses on detecting, exploiting, and bypassing Cross-Site Scripting (XSS) vulnerabilities, covering reflected, stored, and DOM-based XSS. It includes practical steps for lab setup, identifying input fields, injecting payloads, and employing obfuscation techniques. Key techniques include using basic payloads, event handlers, and URL-based injections to test for vulnerabilities and bypass filters.

Uploaded by

iphoneboeken
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

Lesson 2: Cross-Site Scripting (XSS)

Objective: Learn to detect, exploit, and bypass XSS vulnerabilities by working with different types of XSS: reflected, stored, and DOM-based. We’ll cover basic payloads,
obfuscation techniques, and ways to test various encoding bypasses.

Step 1: Lab Setup

1. Set up DVWA or Mutillidae on a local environment like XAMPP or Kali Linux VM if you haven’t already.
2. Configure Security Level:
• In DVWA, set the security level to “low” in the settings.
• This allows for testing without additional filters in place.

Step 2: Detect Reflected XSS

1. Identify Input Fields:


• In DVWA, navigate to the XSS Reflected page.
• Look for input fields where you can enter text that is directly displayed on the resulting page.
2. Basic Detection:
• Enter a simple payload like <script>alert(1)</script>.
• If the application immediately triggers an alert box, it’s vulnerable to XSS.
3. Alternative Payloads:
• Try other payloads like <img src=x onerror=alert(2)> to test if the application filters out <script> tags specifically but not other tags.
• Using different tags checks for encoding or tag restrictions.

Step 3: Exploiting Stored XSS

1. Navigate to a Page with Persistent Input:


• Go to the XSS Stored page in DVWA, where you can post comments or messages that get stored on the page.
2. Inject Persistent Payloads:
• Enter <script>alert(3)</script> in the comment field and submit it.
• Refresh the page to see if the alert box triggers again. If it does, the application has stored the XSS payload, which will run each time the page loads.
3. Bypass Basic Filtering:
• If your payload is blocked, try variations:
• Use mixed-case tags: <ScRiPt>alert(4)</ScRiPt>.
• Use HTML encoding for characters: &lt;script&gt;alert(5)&lt;/script&gt;.
• Test to see if the application decodes these encodings, allowing the payload to execute.

Step 4: DOM-Based XSS

1. Inspect the DOM-Based XSS Page:


• Go to the XSS DOM page in DVWA.
• Here, the payload is reflected in the URL but executed in the browser’s DOM without a request to the server.
2. Craft a URL-Based Payload:
• Add #<script>alert(6)</script> to the end of the URL (e.g., http://yourapp/XSS_DOM.php#<script>alert(6)</script>).
• If this triggers an alert, the application directly injects the payload from the URL into the page’s HTML or JavaScript.
3. Bypassing URL Filtering:
• If filters are in place, try obfuscation techniques, like encoding characters in the payload. For instance:
• Replace <script> with %3Cscript%3E.
• Experiment with breaking up tags, like <img src=x onerror=alert('7')> encoded with %3Cimg%20src%3Dx%20onerror%3Dalert%287%29%3E.

Step 5: Advanced Bypass Techniques

1. Event Handlers:
• Many applications restrict <script>, but other HTML tags can trigger JavaScript events. Try:
• <body onload=alert(8)>
• <a href="javascript:alert(9)">Click me</a>
2. Filter Bypasses:
• If certain keywords or characters are blocked, try Unicode encoding or entity encoding for more complex bypasses:
• For example, use &#x61;lert(10) for alert.
• Also, some filters miss characters encoded as &#34; (for "), allowing onerror or onload events.

Step 6: Practice and Review

1. Try Other Input Fields:


• In DVWA or Mutillidae, search for other user input areas and test if XSS can be triggered on other forms, comments, or input fields.
2. Review and Refine Payloads:
• Compare results with different payloads and encoding methods. Document which variations succeeded and why, noting the effectiveness of each technique in
bypassing specific filters.

Summary of Key Techniques

1. Basic Payloads: <script>alert(1)</script> or <img src=x onerror=alert(1)>.


2. Obfuscation: Mixed case tags, encoded tags, and Unicode encoding.
3. DOM-Based Payloads: Inject payloads directly into the URL fragment, e.g., #<script>.
4. Event Handlers: Use non-script tags with events, like <a href="javascript:alert()">.

This lesson provides a hands-on guide for detecting and exploiting various types of XSS vulnerabilities, along with bypass techniques for different filters. Let me know if you’re
ready to dive into the next lesson!

You might also like