Stored XSS into HTML context | شرح ثغرة XSS - Portswigger

Introduction

In this tutorial, we will explore Stored Cross-Site Scripting (XSS) vulnerabilities within an HTML context. This guide is designed for beginners, providing a step-by-step approach to understanding and testing for XSS vulnerabilities, particularly using the PortSwigger labs. By the end of this tutorial, you will gain insights into the differences between Stored XSS and Reflected XSS, practical testing techniques, and how to exploit these vulnerabilities.

Step 1: Understand the Lab Environment

• Access the PortSwigger lab specifically designed for Stored XSS in an HTML context.
• Use the following URL to reach the lab: PortSwigger Lab.
• Familiarize yourself with the layout and features of the lab to effectively test for vulnerabilities.

Step 2: Learn the Differences Between Stored XSS and Reflected XSS

• Stored XSS:
  • The malicious script is stored on the server (e.g., in a database) and executed whenever a user retrieves the stored data.
  • It’s persistent and can affect multiple users.
• Reflected XSS:
  • The script is reflected off a web server immediately in response to a request, often through URL parameters.
  • It is non-persistent, affecting only the user who clicks on the malicious link.

Step 3: Test Input Fields for XSS Vulnerabilities

• Identify input fields in the application that may be susceptible to XSS, such as comment boxes or user profiles.
• Use common payloads to test for vulnerabilities, such as:

  <script>alert('XSS')</script>
  

• Monitor the application’s behavior when the payload is submitted. Look for any stored reflections of your input.

Step 4: Execute the Alert Function to Demonstrate Vulnerability

• Once you identify a vulnerable input field, inject the alert function as a test payload:

  <script>alert('XSS Vulnerability Test')</script>
  

• Submit the input and navigate to the page where the input is displayed.
• If a JavaScript alert appears, it confirms the presence of a Stored XSS vulnerability.

Step 5: Assess the Severity of the Vulnerability

• Evaluate the impact of Stored XSS compared to Reflected XSS:
  • Stored XSS is generally more dangerous due to its persistence and ability to affect multiple users.
  • Consider the potential harm, such as data theft, session hijacking, or spreading malware.

Conclusion

In this tutorial, we covered the fundamentals of Stored XSS vulnerabilities, including how to test for them using PortSwigger labs. You learned to differentiate between Stored and Reflected XSS, how to identify vulnerable input fields, and how to execute a simple alert function to confirm vulnerabilities. To further your skills, practice with other labs and explore advanced exploitation techniques. Stay updated with security trends and continue your learning journey in web application security.