Skills Assessment
We are performing a Web Application Penetration Testing task for a company that hired you, which just released their new Security Blog. In our Web Application Penetration Testing plan, we reached the part where you must test the web application against Cross-Site Scripting vulnerabilities (XSS).
Start the server below, make sure you are connected to the VPN, and access the /assessment directory on the server using the browser:
Apply the skills you learned in this module to achieve the following:
Identify a user-input field that is vulnerable to an XSS vulnerability
Find a working XSS payload that executes JavaScript code on the target's browser
Using the
Session Hijackingtechniques, try to steal the victim's cookies, which should contain the flag
Our target IP :
What is the value of the 'flag' cookie?
Access to our target. We can access to /assessment/index.php/2021/06/11/welcome-to-security-blog/ and leave a comment :
So, we put a php listener on the port 4444 :
Now, try a payload from PayloadAllTheThings :
It's Working, so create a file named script.js :
Use the Blind XSS Found to get a session hijacking :
We get the flag :
Last updated