To test for XSS vulnerabilities, we'll be using JavaScript and standard HTML:

• Testing for Reflected XSS

Remember what we stated before: Reflected XSS is named so because user input is immediately processed and returned by the web app. To test for it, we need to find a field that accepts user input.

Let's log in to the DVWA page that we cracked the password for previously. At the main page, there will be a menu on the left:

Select DVWA Security and, in the drop-down box, select low then click Submit. By doing this, we've set up the web app to operate as though the input is not being validated:

For our first test, navigate on the page that XSS reflected in the left menu. In the input field, type the following JavaScript:

<script>alert(“Allows XSS”)</script>

Click Submit.

If successful, you should a pop-up message box with the Allows XSS message:

Let's try another. Type the following:

<script>window.location=’https://www.google.com’</script>

This redirects the browser to a different website, in our case, google.com.

• Testing for Stored XSS

Stored XSS is named so because it stores itself in a location, albeit a database, and anytime a user visits the affected site, the code executes. An attacker can easily send key information, such as a cookie, to a remote location. To test for it, we need to find a field that accepts user input, for example, a comment field.

Let's navigate on the page that XSS stored in the left menu. We are presented with two input fields: Name and Message. This simulates a basic Comments or Feedback form found on many websites. In the Name field, enter whatever name you would like, but in the Message field enter the following code and click Sign Guestbook:

<script>alert(document.cookie)</script>

Here's the popup we get:

Now, if we navigate away from this page, say to the Home page, then return to the XSS stored page, our code should run again and present a popup with the cookie for the current session. This can be expanded upon greatly, and with a bit more knowledge of JavaScript, an attacker can do a lot of damage.