Task 20 - Cross-site Scripting
Task 20 [Severity 7] Cross-site Scripting
Deploy the VM
No answer needed
Navigate to http://MACHINE_IP/ in your browser and click on the "Reflected XSS" tab on the navbar; craft a reflected XSS payload that will cause a popup saying "Hello".
On the same reflective page, craft a reflected XSS payload that will cause a popup with your machines IP address.
In Javascript window.location.hostname will show your hostname, in this case your deployed machine's hostname will be its IP.
Now navigate to http://MACHINE_IP/ in your browser and click on the "Stored XSS" tab on the navbar; make an account. Then add a comment and see if you can insert some of your own HTML.
On the same page, create an alert popup box appear on the page with your document cookies.
Change "XSS Playground" to "I am a hacker" by adding a comment and using Javascript.
HINT: <script>document.querySelector('#thm-title').textContent = 'I am a hacker'</script>
Last updated