Trying "XSS stored in DVWA" and now I am completely confused. It is not letting me bypass, I tried many inputs and I know what the preg_replace() is doing still nothing seems to work for me. I used the :"img src", "body onload","onmouseoover" etc but nothing seems to work on this case. I also tried unicoded code but still no luck.

  • Have you ensured your security level is low? – meowcat Mar 19 '19 at 23:40
  • No, I was trying to perform it on High level so the security level is set to high. – SAM SAMULE Mar 20 '19 at 18:44

The answer is you should not be able to bypass it.

The "High" setting on DVWA should actually be called "impossible", and in later versions it has been renamed to this (I suspect you are using the DVWA version from Metasploitable, which has an old version).

The idea of having this setting is so you can click the "view source" button on the page, and see how the code 'should' be written, to avoid the attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.