Cross-Site Scripting (XSS) Assessment

Introduction

Cross-Site Scripting (XSS) is a vulnerability that allows attackers to inject malicious JavaScript code into web pages viewed by other users. When the application fails to sanitize user input, attackers can execute scripts within a victim’s browser session.

Objective

The objective of this assessment was to determine whether DVWA properly sanitized user input against XSS attacks.

Target Information

• Target Application: DVWA
• Vulnerability Module: Reflected XSS
• Security Level: Low

Tools Used

• Browser
• Parrot OS

Payload Used

Screenshot

Methodology

1. Opened the Reflected XSS module in DVWA.
2. Entered the JavaScript payload into the input field.
3. Submitted the payload to the application.
4. Observed browser behavior after execution.

Observation

The JavaScript code executed successfully within the browser.

Screenshot

Evidence

• Alert popup appeared on screen.
• Script execution was confirmed.

Explanation

The application reflected user input directly into the webpage without sanitization or output encoding, allowing JavaScript execution.

Impact

• Session hijacking
• Credential theft
• Malicious redirects
• Phishing attacks
• Browser-based malware delivery

Recommendations

• Sanitize user input
• Encode output before rendering
• Implement Content Security Policy (CSP)
• Use secure cookies with HTTPOnly flags

Conclusion

The application was vulnerable to Cross-Site Scripting attacks due to improper input validation and output encoding mechanisms.