Testing for reflected cross-site scripting
Reflected cross-site scripting occurs when malicious JavaScript is injected into an input field, parameter, or header and, after returning from the web server, is executed within the browser. Reflected XSS occurs when the execution of JavaScript reflects in the browser only and is not a permanent part of the web page. Penetration testers need to test all client values sent to the web server to determine whether XSS is possible.
Getting ready
Using OWASP Mutillidae II, let’s determine whether the application protects against reflected XSS.
How to do it...
- From the OWASP Mutillidae II menu, select Login by navigating to OWASP 2013 | A3 - Cross Site Scripting (XSS) | Reflected (First Order) | Pen Test Tool Lookup:
Figure 8.1 – Multillidae landing page
- Select a tool from the drop-down listing and click the Lookup Tool button. Any value from the drop-down list will work for this...
