you will exploit XSS vulnerability in a web application by injecting malicious code using JavaScript

you will exploit XSS vulnerability in a web application by injecting malicious code using JavaScript. In an XSS attack, an attacker posts malicious code through non-sanitized input boxes to the web application. Users who view these malicious codes in the web application become the victims.

You will perform the following XSS attacks on the provided vulnerable web application to:

1. Deface the web application
2. Steal user’s credentials e.g., cookies
3. Illegitimately post messages on behalf of other users.

I have built a vulnerable web application specifically for this lab i have it in zip file you will need to download also i have the fake website ready from the application server

the tasks will be

1_ XSS Vulnerability Check

2_Defacing a webpage using Javascript DOM API

3_ Stealing user’s credentials e.g., cookies

4_Illegitimately posting messages on behalf of the user ( after doing will

1. Identify the HTTP request of the message posting that has been sent to our web application server and observe the URL to which the request was sent to, the request header and the body section of the request.
   In the header and body section of the request, what are the values of the following variables:Header Section: Host, Content-Type, Connection, Cookie Body Section: message_text, post_message
2. Post the following JavaScript into the description textbox of the “Post Message” page replacing the placeholders unknown-2, unknown-3 and unknown-4 with the corresponding values obtained from (f). Replace unknown-5 with the malicious message you would want to be posted on behalf of the victim.
3. Placeholder unknown-1 should be the URL to which the request was sent to
4. .
5. _ for sql injection you will

1. Log into the web application without correct password
2. Elevate user’s account privileges

6_ lastly give some DEFENCE MECHANISMS.