Executing Stored Cross Site Scripting (XSS) Attacks
Last post focused on exploiting reflected cross site scripting (XSS) attacks. To refresh, a reflected XSS attack is when the malicious code only run when a target users visits a specific URL crafted or written by an attacker. This post focuses on the more dangerous stored XSS attack. A stored XSS attack occurs when the JavaScript code gets stored into the database so anytime someone accesses that specific page, the code will be executed. This type of attack is also known as persistent XSS. For this lab, I used Kali Linux ( https://www.kali.org/downloads / ) installed on an Oracle VirtualBox ( https://www.virtualbox.org/wiki/Downloads ). I also used Metasplotable (https://information.rapid7.com/metasploitable-download.html) which comes with the Damn Vulnerable Web Application (DVWA) used to conduct this lab already installed. Lastly, I used the a vulnerable application by Google called Gruyere ( https://google-gruyere.appspot.com/ ) to show different tactics th...