Execute a Reflected Cross-Site Scripting (XSS) Attack

Lab Steps

keyboard_tab
lock
Logging into the Microsoft Azure Portal
lock
Connecting to the Lab Host Virtual Machine Using RDP
lock
Executing a Reflected Cross-site Scripting (XSS) Attack

Ready for the real environment experience?

DifficultyIntermediate
Max Duration30m
Students33
Ratings
5/5
star star star star star

Description

Cross-site scripting (XSS) is a security vulnerability affecting web applications. XSS allows an attacker to execute scripts on the machines of clients of a targeted web application. This can allow attackers to steal credentials and sessions from clients or deliver malware. The Open Web Application Security Project (OWASP) has included XSS in its top ten list of the most critical web application security risks every year the list has been produced. It reports that XSS vulnerabilities are found in two-thirds of all applications.

This Lab demonstrates a reflected cross-site scripting attack. Reflected XSS is sometimes referred to as non-persistent XSS and is the most common kind of XSS. It results from a user clicking a specially-constructed link storing a malicious script that an attacker injects. You will use a web application that is intentionally vulnerable to illustrate the attack.

You will use the web browser on a Kali Linux host to launch the attack on a web application running on a Metasploitable 2 host. Both hosts are running as virtual machines in a Hyper-V virtual environment.

This Lab is designed for the CREST Practitioner Security Analyst (CPSA) certification examination but is of value to security practitioners in general.

Learning Objectives

Upon completion of this Lab you will be able to:

  • Describe the elements of a cross-site scripting attack
  • Perform basic cross-site scripting attacks
  • Understand how to prevent cross-site-scripting attacks

Intended Audience

This Lab is intended for:

  • CREST CPSA certification examinees
  • Security practitioners
  • Web application developers

Prerequisites

You should be familiar with:

  • HTML and JavaScript language basics are beneficial but not required
Environment before
PREVIEW
arrow_forward
Environment after
PREVIEW

About the Author

Students35234
Labs95
Courses11
Learning paths7

Logan has been involved in software development and research since 2007 and has been in the cloud since 2012. He is an AWS Certified DevOps Engineer - Professional, AWS Certified Solutions Architect - Professional, Microsoft Certified Azure Solutions Architect Expert, MCSE: Cloud Platform and Infrastructure, Google Cloud Certified Associate Cloud Engineer, Certified Kubernetes Administrator (CKA), Certified Kubernetes Application Developer (CKAD), Linux Foundation Certified System Administrator (LFCS), and Certified OpenStack Administrator (COA). He earned his Ph.D. studying design automation and enjoys all things tech.

Covered Topics