Kali Linux 2018: Assuring Security by Penetration Testing - Fourth Edition

Testing for XSS

To test for XSS vulnerabilities, we'll be using JavaScript and standard HTML:

• Testing for Reflected XSS

Remember what we stated before: Reflected XSS is named so because user input is immediately processed and returned by the web app. To test for it, we need to find a field that accepts user input.

Let's log in to the DVWA page that we cracked the password for previously. At the main page, there will be a menu on the left:

Select DVWA Security and, in the drop-down box, select low then click Submit. By doing this, we've set up the web app to operate as though the input is not being validated:

For our first test, navigate ...