Cross-Site Scripting (XSS) Hack The box Module 103
$19.00
Secure checkout
Instant digital download
PDF document
Document details
- Pages
- 22
- File size
- 2.28 MB
- Format
- Digital PDF
- Course
- Computer Networking
- Category
- EXAM
Sign in or create a free account to continue. Your purchase will be saved in My Downloads.
About this ebook
Cross-Site Scripting (XSS):
Link to challenge: https://academy.hackthebox.com/module/103
(log in required)
Class: Tier II | Easy | Offensive
XSS Basics
Stored XSS:
Question: To get the flag, use the same payload we used above, but change its JavaScript code to show the cookie instead of showing the url.
Answer: HTB{570r3d_f0r_3v3ry0n3_70_533}
Method: first, lets open the website in the browser:
http://:
We can add some tasks.
To get the cookie, we will add the following ‘task’:
The flag will appear on alert window
Reflected XSS:
Answer: HTB{r3fl3c73d_b4ck_2_m3}
Method: in this question we will get to the same looking website as before, and we will enter to the input box this payload:
Task '' could not be added.
The difference is, with this payload we will affect the html page as well:
DOM XSS:
Answer: HTB{pur3ly_cl13n7_51d3}
Method: the ‘task’ we will add to the website input box is:
XSS Discovery:
Question: Utilize some of the techniques mentioned in this section to identify the vulnerable input parameter found in the above server. What is the name of the vulnerable parameter?
Answer: email
Method: in this section we get to a new website:
Which have 4 different input parameters, and we need to determine which one is XXS vulnerable.
Lets use burpsuite to intercept registration request to see what are the parameters names:
File included
Cross_Site_Scripting__XSS_.pdf.pdf
2.28 MB
Related ebooks
