Lesson 3 Demo 2

Cross Site Scripting (XSS)

Objective: Perform XSS on a live website to execute a malicious script in the Browser

Tools required: Browser

Prerequisites: None

Steps to be followed:

1. Performing Cross Site Scripting using vulnweb

Step 1: Performing Cross Site Scripting using vulnweb

1.1 Open the vulnerable site to perform the attack: http://vulnweb.com/

1.2 Click on Acuart link: http://testphp.vulnweb.com/

1.3 In the search art field enter the following code and click the go button:

<script>alert(“hacked”)</script>
1.4 If the XSS is successful, you should be able to see an alert message hacked:

1.5 Click on the Signup Page and login using the username test and the password test:

1.6 After successful login you should see the profile details for user test:
1.7 In the Your Profile page, enter the following code in the Name field and click the update
button:

<script>alert(document.cookie)</script>
1.8 You should be able to see the cookie value for the user test:

1.9 In the Your Profile page, enter the following code in the Name field and click the update
button:

<script>window.location.href=”https://example.net”</script>
1.10 This code will redirect the user to another site. Every time the user logs in to the site
from the signup page, the user is automatically redirected to a fake site: