XSS Attacks

80 Chapter 3 9 XSS Theory

If you press the Chat button, you will inject the malicious payload into the DOM. This

payload composes a string that looks like the following:

<p>Welcome

<script>alert('xss')</script>!

You can type your message into the form

below.</p><textarea class="pane"><script>alert('xss')</script> &gt; </textarea>

This is known as non-persistent DOM-based XSS. Figure 3.10 shows the output of the

exploit.

Figure 3.10 XSS Exploit

Output at the Login

Exploiting Non-persistent

DOM-based XSS Vulnerabilities

Like the normal XSS vulnerabilities discussed previously in this chapter, DOM-based ...