image.png

Overview

This project explored the exploitation of Cross-Site Scripting (XSS) vulnerabilities using the Damn Vulnerable Web Application (DVWA). The exercise was designed to simulate real-world web application attacks where user-supplied input is not properly validated or sanitized. The lab provided hands-on experience in executing both Reflective XSS and Stored XSS across multiple security levels (Low, Medium, High), demonstrating how varying coding practices impact the security of a web application.

The Challenge

The challenge was to determine how input validation weaknesses could be exploited in DVWA to inject and execute malicious scripts. Reflective XSS tested the immediate response of the application to injected payloads, while Stored XSS focused on persistent attacks where the malicious input was saved and re-executed whenever the page was loaded. These attacks model real adversarial tactics used to steal credentials, hijack sessions, or distribute malware.

The Approach

The approach followed a penetration testing methodology:

  1. Identify vulnerable input points in DVWA.
  2. Inject crafted payloads using JavaScript.
  3. Test across Low, Medium, and High security levels.
  4. Analyze backend code where accessible to understand filtering methods.
  5. Attempt bypasses by modifying payloads.
  6. Evaluate the implications of successful injections.

This structured progression mirrored the escalation techniques attackers use when facing different defensive implementations.

Tools used