Practical Web Penetration Testing

JavaScript validation

What if the page is protected by JavaScript validation, do you think we still can hack it? Of course we can; the JavaScript validation is not enough—we should do it on the server as well. Let's see how to overcome JavaScript using Burp:

1. First, we will switch the security level to 1, which will enable JavaScript validation, by clicking on the Toggle Security button in the Mutillidae menu bar:

2. Try to visit the same page above from the menu; on the left menu, choose OWASP 2017 | Cross Site Scripting | Reflected | DNS Lookup and let's try to execute our alert script:

As you can see, the script was blocked by the browser, ...