Sec-Art: XSS

Showing posts with label XSS. Show all posts

bWAPP (buggy web application) XSS Examples Solution | bWAPP XSS Challenges Walk-through

bWAPP, or a buggy web application, is a free and open source PHP based web application for Practicing Web Pentesting and learn about web vulnerabilities in a safe environment. Its main goal is to provide a safe and legal environment for security professionals and students to test their skills and tools and learn about Web security.

How to Install bWAPP (buggy Web App) Web Application on Windows with XAMPP

DVWA(Damn Vulnerable Web App) XSS Examples Solution | DVWA XSS Challenges Walk-through

DVWA or Damn Vulnerable Web App is a PHP based web application for Practicing Web Pentesting and learn about web vulnerabilities in a safe environment. Its main goal is to provide a safe and legal environment for security professionals and students to test their skills and tools and learn about Web security. In This post we are trying to exploit the XSS vulnerabilities in DVWA. Now lets start :

How to Install DVWA(Damn Vulnerable Web App) Web Application on Windows with XAMPP

How to Hunt for XSS vulnerability

When hunting XSS vulnerabilities, the first step is to identify the input fields such as cookies, headers, forms and so on., where the web application that will send back to the browser the data entered in those fields, either immediately (reflected XSS) or later after a specific query (stored XSS). Here are some common scenarios where XSS can be found:

XSS Payloads Collection and Important Links

Some of the XSS payloads that i have used during tests for xss vulnerability are here :

For checking XSS filters use the below character set :

/"'\<><script>():;[]{}AbC

Simple payloads for testing XSS :

Web for pentester VM XSS Examples Walk-through ( XSS Solutions )

Web for Pentester is a pre-configured Virtual Machine ISO prepared for practicing Web Pentesting by PentesterLab. Now in this article we going to look at the XSS vulnerabilities. And in order to setup the Virtual Machine, please visit the link :

What is DOM Based XSS | XSS Basics

The DOM-Based Cross-Site Scripting is vulnerability which appears in document object model instead of html page. In a DOM-based XSS attack, the malicious string is not actually parsed by the victim's browser until the website's legitimate JavaScript is executed. But before going into the details of how DOM based xss works, lets first see What is DOM ?

What is Stored XSS | Persistent XSS | XSS Basics

The Stored XSS also known as persistent XSS attack is one of the three categories of XSS attack. The Stored xss occurs when a malicious script is injected directly into a vulnerable web application, and the injected script get permanently stored inside the web application server. And when a victim navigates to the affected web page in a browser, the XSS payload will be served as part of the web page and victims will inadvertently end-up executing the malicious script once the page is viewed in a browser. Since this vulnerability typically involves at least two requests to the application, this may also called second-order XSS. Stored XSS does not need a malicious link to be exploited. A successful exploitation occurs when a user visits a page with a stored XSS. The following phases relate to a typical stored XSS attack scenario:

What is Reflected XSS | Non-Persistent XSS | XSS Basics

Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off of a web application to the victim's browser. In Reflected XSS the malicious string originates from the victim's request. It is one of the most widely exploited web application vulnerabilities. To exploit this vulnerability, the application takes one or more parameters as an input, which is reflected back to the web page generated by the application. This may not sound harmful at the moment but this vulnerability can be exploited to do one of the following things or more:

What is Cross-Site Scripting ? | XSS Guide For Beginners

Cross Site Scripting or XSS is one of the most common web application vulnerability that allows an attacker to run his own client side scripts into web pages viewed by other users. It is a code injection attack that allows an attacker to execute malicious JavaScript in another user's browser. XSS is the most common security vulnerability in software today. In an XSS attack the attacker does not directly target his victim. Instead, he exploits a vulnerability in a website that the victim visits, in order to get the website to deliver the malicious JavaScript for him. To the victim's browser, the malicious JavaScript appears to be a legitimate part of the website, and the website has thus acted as an unintentional accomplice to the attacker.