I am using DVWA and having trouble executing a simple, reflected XSS vulnerability. Entering the suggested text does not produce a popup in either Firefox or Chrome. Are there any settings that I need to adjust to execute the reflected XSS attack? Is there something else that I'm missing?
If it's a reflected XSS vulnerability, many modern web browsers have features that prevent it from executing. I believe if you look in your console it will display a message if it detected malicious input and prevented it from executing.
Take a look at this question for more info.
I believe it's possible to disable this feature if you start chrome from the command line and pass in the
The entered text appears to be being rendered in HTML (assuming that what is displayed in red there is your exact actual input).
Make sure that Security Mode has been set to either Low or Medium. The High level is supposed to be secure, so you cannot really exploit it in this mode unless you find a new attack vector that everyone else has missed.