In DVWA I'm trying to understand different methods of attack than the usual alert('XSS'); scenario.

I am using reflective XSS to deliver a payload which then makes the user who follows the URL submit a post in the Stored XSS section on the same web application. Here is my external JS code

var pagech = document.getElementsByTagName('a')[11].click(); 
var name = document.getElementsByName("txtName")[0].value="helloworld"; 
var comment = document.getElementsByName("mtxMessage")[0].value="helloworld2";
var sub = document.getElementsByTagName('input')[1].click();

This code basically switches the page to the stored xss page and enters some values then submits the form, it works inside the firebug console but not when I run it using the reflective xss vulnerability below.

<script src=""></script>

Instead the users page switches but the post is not submitted. How can i fix this if it is possible?

  • 1
    Are you sure that the DOM is ready when the JS is executed?
    – Anders
    Commented Sep 2, 2016 at 12:52
  • it won't work this way - after switching the page the rest of your code will not become executed...
    – DaniEll
    Commented Sep 2, 2016 at 12:57
  • If you can make the victim click on a link pointing to a proxy you control, you could imtercept any request and send some on your own by injecting JavaScript inside HTML. Given that, yes it would maybe work. It would depend of your ability to prevent your injected stuff of breaking code. But for different other reasons , like software firewall and anti csrf protections it might not works. There is also the obvious fact that at some point the client might realize he/she is not on the good site because the adress does not match. This could be tanned with funny adress but heh, this is internet
    – happy
    Commented Sep 5, 2016 at 1:42

3 Answers 3


There is a major difference between code executed in the developer console step by step[!] and JavaScript that's part of the page:
All running JavaScript is stopped when you navigate away to another page.

But why would you bother to write JavaScript to mimic a user?

If you want to send a POST-Request (for example send something that looks like a user submitting a form) use an AJAX-POST-Request like shown in this Stack Overflow Answer


If you want to submit your POST from the website itself (maybe to circumvent some CSRF controls), then you'd have to think of a clever way to run your script while the form is visible.

For example:

  • Load an IFrame in the XSS vulnerable page with the form's URL, populate it using the Iframe's document object, then submit it.
  • Make an AJAX request to the form's URL, read the form parameters into JavaScript and then make an AJAX POST.

Causing a top level navigation with your payload will prevent any more of your script from running, therefore you must use DOM or JavaScript objects to store the content of other site items that you wish to manipulate.


Maybe, you could inject your payload using HTTP GEt Request; you could use an img tag.

<img src="" />

Or change your script and create it in an dynamic way.

var value1 = document.getElementById("txtName").value;
var value2 = document.getElementById("mtxMessage").valued;

I hope this information helps you.

Good luck.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .