I am going through the WebGoat exercises, to refresh my knowledge of XSS attacks.
Stage 3 has a built in XSS code snippet, that upon viewing a profile will show the contents of 'document.cookie'.
What I would like to know is why I can't do the same in a very simple, deliberately vulnerable to XSS web application. Is there some XSS detection in all modern browsers preventing this? I've tried with he options to disable web security on IE, Firefox and Chrome and it makes no difference.
edit: Things I have tried for both WebGoat 5.4 and WebGoat 6.0.1:
- Accessing via Firefox with a new, default profile and no addons
- Chrome with the --disable-web-security and/or –disable-xss-auditor arguments
- Accessing via Mantra
- Setting the X-XSS-Protection header to 0 in my requests.
Is WebGoat trying to teach about an XSS attack that is no longer a threat?
Per Martin's answer, I tried setting the header manually as seen in the screenshots below. I modified the lesson title so it is obvious fiddler is correctly intercepting the page.
What property of this cookie is preventing it from being read?