Skip to content

Latest commit

 

History

History

system-security-1

README.md

4️⃣ 4 - Cross-Site Scripting (XSS)

Topics

  1. XSS Anatomy
  2. Reflected XSS
  3. Stored XSS
  4. DOM-Based XSS
  5. Identifying & Exploiting XSS with XSSer

{% embed url="https://owasp.org/www-community/attacks/xss/" %}

Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) constitutes a client-side web vulnerability enabling attackers to embed malicious scripts into web pages.

This vulnerability often arises from inadequate input sanitization/validation within web applications.

Attackers exploit XSS vulnerabilities to insert harmful code into web applications. Given that XSS is a client-side vulnerability, these scripts execute within the victim's browser.

XSS vulnerabilities impact web applications deficient in input validation and reliant on client-side scripting languages such as JavaScript, Flash, CSS, etc.

Web Basics

{% content-ref url="https://app.gitbook.com/s/iS3hadq7jVFgSa8k5wRA/practical-ethical-hacker-notes/main-contents/14-hacking-web-apps" %} 14 - Hacking Web Apps {% endcontent-ref %}

Practise

🔬 There are many vulnerable testing web apps like:

DVWA

The Damn Vulnerable Web Application (DVWA) is a web application built with PHP and MySQL intentionally designed to be susceptible to security vulnerabilities. Its primary purpose is to serve as a resource for security professionals to assess their skills and tools within a legal context. Additionally, it aids web developers in gaining a deeper understanding of the processes involved in securing web applications and facilitates learning about web application security for both students and teachers in a controlled classroom setting.

DVWA is designed to provide a platform for practicing various common web vulnerabilities at different difficulty levels, all presented through a simple and user-friendly interface. It's important to note that there are deliberate both documented and undocumented vulnerabilities within the software, encouraging users to explore and identify as many issues as possible.

{% embed url="https://github.com/digininja/DVWA" %} DVWA {% endembed %}

{% embed url="https://portswigger.net/web-security/cross-site-scripting/cheat-sheet" %}

DVWA - My Writeups

{% content-ref url="https://app.gitbook.com/s/rRWtuMw6xkkeDjZfkcWC/dvwa" %} DVWA {% endcontent-ref %}

Theory and Lab platform

{% embed url="https://portswigger.net/web-security/all-labs" %} Web Burp Suite Security Academy {% endembed %}

❗ Disclaimer

Never use tools and techniques on real IP addresses, hosts or networks without proper authorization!

❗_Never run these techniques on un-authorized addresses_