HOW TO USE XSS (OWASP TOP 10 VULNEREABILITY )

OWASP

Top Vulnerabilities

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.

So this vulnerability is very critical.    

Requirements:-

1.     Any OS

2.     Xampp Server

3.     Web vulnerable web application(DVWA)

Firstly set security level: Low

Now, do the following Steps

1.     Open login page of DVWA website

2.     Go to XSS option

3.     Select reflected XSS

Vulnerable vector

Copy this and paste in the dialogue box

<script>alert(0)</script>

When you submit this, it show a pop up you displaying 0 zero, and then press ok

Then copy this and paste in the same dialogue box

<script>alert(“XSS”)</script>

 

When you submit, this time pop up displaying XSS on it.

Now the trick
you have to replace the word alertto prompt.

Then a pop up comes up displayingXSS, put your name in the blank. (ex:Sachin)

Now, again paste the second command and replace

XSS to documentation.cookiescopy this and paste in it.

<script>prompt(“documentation.cookies”)</script>

Now pop up will show displaying documentation.cookies again type your name on it (ex:sachin)

Now again you have to replace documentation.cookies to documentation.domain, when you press submit

pop up will appear and dislplaying  127.0.0.1 put your name in it. Just like before.

All done in XSS (reflected)…

Now select XSS(stored) next to XSS(reflected)

Put any name in it and in the message box put this

<script>prompt(“documentation.domain”)</script>

 Logout from the account…
Go to the login page
Username: admin

Password: password

Click XSS stored, Pop up comes up displaying 127.0.0.1; put your name in it.

All Done.

So as any Hacker inject our script in website and they can change everything.

Thanks for reading this article.

Author: Sumreet Sharma  is An Certified Ethical hacker, Penetration tester,  junior security analyst network engineer technical writer  n pursuing in Microsoft software engineer, India.

Contact here: https://goo.gl/unp1AA