Python Penetration Testing Essentials - Second Edition

Nonpersistent or reflected XSS

In this type of attack, the input of the attacker is not stored in the database server. The response is returned in the form of an error message. The input is given with the URL or in the search field. In this chapter, we will work on stored XSS.

Now, let's look at the code for the XSS attack. The logic of the code is to send an exploit to a website. In the following code, we will attack one field of a form:

import mechanize import re import shelve br = mechanize.Browser() br.set_handle_robots( False ) url = raw_input("Enter URL ") br.set_handle_equiv(True) br.set_handle_gzip(True) #br.set_handle_redirect(False) br.set_handle_referer(True) br.set_handle_robots(False) br.open(url) s = shelve.open("mohit.xss",writeback=True) ...