OWASP Exercises: Cross-Site Scripting Attack

Developed with
QA

Lab Steps

lock
Logging into the Microsoft Azure Portal
lock
Connecting to the Lab Host Virtual Machine Using RDP
lock
Load the Virtual Machines (Kali & Metasploitable)
lock
Access the DVWA website
lock
Set DVWA security to "Low"
lock
Conducting a simple Reflected XSS attack
lock
Stealing a Session Cookie

Ready for the real environment experience?

DifficultyIntermediate
Time Limit1h
Students53
Ratings
3.6/5
star star star star-half star-border

Description

Cross-Site Scripting Attacks, better known as XSS Attacks, are where an attacker sends malicious code through a trusted web site. The malicious code is sometimes a script (such as a JavaScript snippet) and it's sent through input fields located on the website.

In this lab, you will conduct an XSS attack through a DVWA (Damn Vulnerable Web Application) and exploit a vulnerability to hijack a user's browser session cookie.

Learning Objectives

Upon completion of this lab, you will be able to:

  • Navigate through DVWA to perform an XSS attack to retrieve a session cookie

Intended Audience

This lab is intended for:

  • Individuals who want to learn how to perform XSS attacks through websites
  • Security engineers who want to understand the security level of their websites to avoid XSS attacks
  • People who want to know how an XSS attack can be performed

Prerequisites

This lab has no prerequisites.

Environment before
PREVIEW
arrow_forward
Environment after
PREVIEW

About the Author

Richard Beck is Head of Cyber Security at QA, responsible for the entire Cyber Security portfolio. He works with customers to build effective and successful security training solutions tailored to business needs. Richard has over 10 years' experience in senior Information Security roles. Prior to QA, Richard was Head of Information Security for four years at Arqiva, which underpin 20% of the UK's Critical National Infrastructure. Richard also held Security and Technical Management posts at CPP, GEC, Pearson and the Royal Air Force. Richard sits on the IBM European Board of Security Advisors and previously chaired the Communication Industry Personnel Security Information Exchange (CPNI).