Tryhackme XSS

Introduction

Cross-Site Scripting (XSS) is a common web vulnerability that allows attackers to inject malicious JavaScript into web pages viewed by other users. These scripts execute in the victim’s browser and may lead to session hijacking, credential theft, or unauthorized actions.

Get Abbhi’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

In this lab, I performed practical exploitation of:

• Reflected XSS
• Stored XSS
• DOM-Based XSS

and learned mitigation techniques to prevent these vulnerabilities.

🔬 Lab 1: Reflected XSS

🎯 Objective

The goal of this task was to identify a reflected parameter and execute a JavaScript payload through user input.

🧪 Steps Performed

1. Opened the vulnerable search page.
2. Entered a test input:

test123

1. Observed that the input was reflected back on the webpage.
2. Injected payload:

<script>alert(1)</script>

1. The alert popup executed successfully.

✅ Result

This confirmed the presence of Reflected XSS vulnerability because the application displayed user input without sanitization.

📌 Impact

Reflected XSS can:

• execute malicious scripts in victim browsers
• steal session cookies
• redirect users to phishing websites

🔬 Lab 2: Stored XSS

🎯 Objective

The objective was to inject a persistent payload into a comment or message field and verify automatic execution after page reload.

🧪 Steps Performed

1. Located the comment/input field.
2. Entered payload:

<script>alert("Stored XSS")</script>

1. Submitted the form.
2. Reloaded the page.

The script executed again automatically.

✅ Result

This confirmed the presence of Stored XSS vulnerability because the payload was stored in the database and executed repeatedly.

📌 Impact

Stored XSS can:

• affect multiple users
• steal authentication cookies
• modify webpage content
• perform actions on behalf of users

🔬 Lab 3: DOM-Based XSS

🎯 Objective

The objective was to exploit a client-side vulnerability caused by unsafe JavaScript DOM manipulation.

🧪 Steps Performed

A vulnerable JavaScript function used user input directly:

document.write("Hello " + name);

Payload injected:

<script>alert(1)</script>

The script executed inside the browser.

✅ Result

This confirmed DOM-Based XSS vulnerability caused by unsafe DOM handling.

📌 Impact

DOM-based XSS can:

• execute malicious scripts locally in browser
• bypass server-side filtering
• manipulate webpage content dynamically

🛡️ Mitigation Techniques

The following techniques help prevent XSS attacks:

• Validate user input
• Sanitize special characters
• Encode output before displaying
• Avoid using document.write()
• Implement Content Security Policy (CSP)

🧩 Conclusion

In this lab, different types of Cross-Site Scripting vulnerabilities were identified and exploited successfully. Reflected XSS executes immediately through URL parameters, Stored XSS persists in databases and affects multiple users, and DOM-based XSS occurs through unsafe client-side scripting. Proper validation and encoding techniques are necessary to prevent such vulnerabilities in web applications.