[Day 9] 2. XSS Types

1. XSS (DOM-Based)

• What is it?

  • DOM-Based XSS, also called Type-0 XSS, occurs when the malicious script is executed directly in the browser through client-side JavaScript.
  • The attack exploits the DOM (Document Object Model) without involving the server.

• How to perform in DVWA?

  • Navigate to the DOM XSS section in DVWA.
  • Enter a script payload (e.g.,
    Copy

    <script>alert('DOM XSS');</script>

    ) in input fields or URL parameters.
  • The script will execute if the application improperly handles client-side input.

2. XSS (Reflected)

• What is it?

  • Reflected XSS happens when user input is immediately included in the response from the server and executed in the victim's browser.
  • The malicious payload is typically delivered via URLs, emails, or search boxes.

• How to perform in DVWA?

  • Go to the Reflected XSS section.
  • Input a payload like
    Copy

    <script>alert('Reflected XSS');</script>

    in any input field (e.g., search or name fields).
  • If vulnerable, the browser will execute the script.

3. XSS (Stored)

• What is it?

  • Stored XSS occurs when the malicious script is permanently stored on the server (e.g., in a database, message board, or comments).
  • The script executes whenever a user accesses the infected resource.

• How to perform in DVWA?

  • Open the Stored XSS section.
  • Submit a payload like
    Copy

    <script>alert('Stored XSS');</script>

    in a form (e.g., a comment box).
  • When the data is retrieved and displayed to users, the script will execute.

Key Points

|Type|Characteristics|Delivery Method| |---|---|---| |DOM-Based|Executes entirely in the browser.|URL or client-side scripts.| |Reflected|Immediate response from the server.|URL or form submission.| |Stored|Script is saved on the server.|Persistent forms or fields.|