0

I am using DVWA and having trouble executing a simple, reflected XSS vulnerability. Entering the suggested text does not produce a popup in either Firefox or Chrome. Are there any settings that I need to adjust to execute the reflected XSS attack? Is there something else that I'm missing?

enter image description here

| improve this question | | | | |
  • 1
    Many of us are not familiar with the Damn Vulnerable Web App. Could you give us more details on what you have tried, and the manual you are following! – Ohnana Feb 26 '16 at 16:01
  • Everytime when I try to inject a malicious payload, on any Vulnerable WebApp, doesn't work! – TMoraes Feb 26 '16 at 19:05
6

If it's a reflected XSS vulnerability, many modern web browsers have features that prevent it from executing. I believe if you look in your console it will display a message if it detected malicious input and prevented it from executing.

Take a look at this question for more info.

I believe it's possible to disable this feature if you start chrome from the command line and pass in the --disable-xss-auditor flag.

| improve this answer | | | | |
  • I don't believe that this is the case because the input is reflected in HTML. Web browser XSS filters try to stop the script from executing, they don't output the code instead. – SilverlightFox Feb 28 '16 at 11:25
  • You right, but I disabled it in Firefox. I was looking for how to disable in linux chrome, didnt find! – TMoraes Feb 28 '16 at 14:18
  • 2
    @TMoraes Burp Proxy has request rewriting to modify the header such that Chrome will allow XSS. – Ohnana Mar 2 '16 at 17:31
1

The entered text appears to be being rendered in HTML (assuming that what is displayed in red there is your exact actual input).

Make sure that Security Mode has been set to either Low or Medium. The High level is supposed to be secure, so you cannot really exploit it in this mode unless you find a new attack vector that everyone else has missed.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.