Identifying Cross-Site Scripting vulnerabilities

Cross-Site Scripting (XSS) is one of the most common vulnerabilities in web applications; in fact, it is considered third in the OWASP Top 10 from 2013 (https://www.owasp.org/index.php/Top_10_2013-Top_10).

In this recipe, we will see some key points in identifying an XSS vulnerability in a web application.

How to do it...

Let's look at the following steps:

1. We will use Damn Vulnerable Web Application (DVWA) for this recipe. Log in using the default admin credentials (admin as both username and password) and go to XSS reflected.

2. The first step in testing for a vulnerability is to observe the normal response of the application. Introduce a name in the textbox and click...