What you will do
You will do cross-site scripting (XSS) on DVWA at the low level, read the code that allows it, and then see the same attempt do nothing at the impossible level. A website that puts what you type into its page without making it safe lets you add your own HTML, and with it your own program.
The one rule
Warning
This lab runs a website that is insecure on purpose. Attack it, and nothing else. It is your own private copy with no way out to the internet, so nobody else can be affected. Never try these things on a site that is not yours: in the UK that is a crime under the Computer Misuse Act 1990.
Before you start
Note
Press Start the lab on the bar at the top of this lesson and wait until it says it is running. The website opens from the DVWA link on the bar. Each Run button below types its command into your lab's terminal, one after another in the same session. To watch them, or to type your own, press Open terminal on the bar.
1. Check the website is running
200 means the sign-in page answered from your terminal.
curl -s -o /dev/null -w "%{http_code}\n" http://dvwa/login.phpShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
2. Sign in and open the exercise
Press the DVWA link on the lab bar and sign in as admin with the password password. In DVWA Security check the level is low. Then choose XSS (Reflected) in the menu. It asks for your name and says hello.
3. Add your own HTML
Type <b>hi</b> as your name and press Submit. It does not say "Hello <b>hi</b>" with the tags showing: it says Hello and then a bold hi. The website drew your tags as part of its page.
Now type <script>alert(1)</script>. The browser runs it: a box says 1. An attacker would put something worse in a link and send it to somebody.
4. Read the code, then see the fix
Press View Source. At low the code puts your text straight into the page. Now set DVWA Security to impossible, go back to XSS (Reflected) and type <b>hi</b> again: the page shows the tags as plain text, <b>hi</b>, and nothing runs. View Source shows why: the code makes your text safe first with htmlspecialchars. It turns < into <, which the browser draws as < on the screen but never reads as the start of a tag.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. This is the same lab as DVWA Basics. The same exercise at low and at impossible is the same code, insecure and then fixed, which is what makes DVWA good for secure coding units. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.