Xss is easy to use

Xss vulnerability

Here I will use the target machine dvwa to briefly introduce the reflective xss vulnerability.

Cross-site script (Cross Site Scripting) is abbreviated as XSS because it is not confused with the abbreviation of cascading style sheets (Cascading Style Sheets, CSS). Malicious users insert malicious Script code into the Web page, and when the user browses the page, the Script code embedded in the Web will be executed, thus achieving the purpose of malicious users.

The website can be inserted directly into alert (/ xss/) without any filtering.

You can pop up the word xss on the web page.

You can also enter

And the use of xss can show cookie, we all know that after obtaining cookie.

Alert ([xss_clean])

While some websites are filtered, we can repeat them at this time.

Alert ([xss_clean])

We write one in front and the previous one constitutes a new cookie so you can get the site. And the site is not filtered.

So we can also use

Some websites do not filter the whole, but the letters, which make it impossible for us to use, but it does not filter.

So we can use the

There are three types of Xss vulnerabilities: reflective, memory and Dom. Here are some simple exploits of reflective xss vulnerabilities.