Testing for JavaScript execution
JavaScript execution is the ability to inject and execute JavaScript in a website even if the website has some kind of protection, such as encoding certain characters. For many attackers, simple encoding of characters is not always a challenge; they find a way to bypass this encoding by creating a more complicated payload that is converted by the backend server as JavaScript and is allowed to run on the website.
Getting ready
This lab requires a PortSwigger academy account and ZAP to intercept requests and responses from the server to your browser.
How to do it...
In this recipe, we are going to bypass an encoding mechanism to deliver our payload. You’ll see that we can inject JavaScript into the page and activate the payload because we’ll discover a way to get around the encoding method.
Take the following steps to get started:
- Navigate to the URL with the browser proxied to ZAP and log into the PortSwigger Academy...
