I am using DVWA and having trouble executing a simple, reflected XSS vulnerability. Entering the suggested text does not produce a popup in either Firefox or Chrome. Are there any settings that I need to adjust to execute the reflected XSS attack? Is there something else that I'm missing?

enter image description here

  • 1
    Many of us are not familiar with the Damn Vulnerable Web App. Could you give us more details on what you have tried, and the manual you are following!
    – Ohnana
    Commented Feb 26, 2016 at 16:01
  • Everytime when I try to inject a malicious payload, on any Vulnerable WebApp, doesn't work! Commented Feb 26, 2016 at 19:05

2 Answers 2


If it's a reflected XSS vulnerability, many modern web browsers have features that prevent it from executing. I believe if you look in your console it will display a message if it detected malicious input and prevented it from executing.

Take a look at this question for more info.

I believe it's possible to disable this feature if you start chrome from the command line and pass in the --disable-xss-auditor flag.

  • I don't believe that this is the case because the input is reflected in HTML. Web browser XSS filters try to stop the script from executing, they don't output the code instead. Commented Feb 28, 2016 at 11:25
  • You right, but I disabled it in Firefox. I was looking for how to disable in linux chrome, didnt find! Commented Feb 28, 2016 at 14:18
  • 2
    @TMoraes Burp Proxy has request rewriting to modify the header such that Chrome will allow XSS.
    – Ohnana
    Commented Mar 2, 2016 at 17:31

The entered text appears to be being rendered in HTML (assuming that what is displayed in red there is your exact actual input).

Make sure that Security Mode has been set to either Low or Medium. The High level is supposed to be secure, so you cannot really exploit it in this mode unless you find a new attack vector that everyone else has missed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .