OWASP Security Shepherd Project - Cross Site Scripting Lesson

What is Cross Site Scripting Vulnerability/Threat?

    Cross-Site Scripting(XSS) happens when an application uses untrusted data to show on web browser without sufficient validation or escaping. If the untrusted data contains client side scripts, the browser will execute the script when it is interpreting the page.
    Attackers can leverage XSS attacks to execute scripts in a victim's browser which can hijack user sessions, change original web sites, or redirect the user to malicious sites. Any user who can send data to the system, including administrators, are possible candidates for performing XSS attacks in an application if the application use those data to compose its web pages.
    According to OWASP, XSS is the most widespread vulnerability found in modern web applications. This is partially due to the variety of attack vectors that are available. The easiest way of showing an XSS attack executing is using a simple alert box as a client side script pay load. To execute a XSS payload, a variety of an attack vectors may be necessary to overcome insufficient escaping or validation. The following are examples of some known attack vectors, that all create the same alert pop up that reads "XSS".

<SCRIPT>alert('XSS')</SCRIPT>
<IMG SRC="#" ONERROR="alert('XSS')"/>
<INPUT TYPE="BUTTON" ONCLICK="alert('XSS')"/>
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>

Lesson

     In this lesson, we are ask to leverage the search bar to show an XSS.
     First, let input arbitrary value to see what happens. (Ex: pikachu)


    No results found! However, we could notice that the web application shows the search term "pikachu" we input directly on the webpage. Let's see what happen if we input the XSS attack factor. (Ex: <SCRIPT>alert('XSS')</SCRIPT>)


    Here comes the XSS and this complete our lesson : P