Testing for stored cross-site scripting
Stored cross-site scripting occurs when malicious JavaScript is injected into an input field, parameter, or header and, after returning from the web server, is executed within the browser and becomes a permanent part of the page. Stored XSS occurs when the malicious JavaScript is stored in the database and is used later to populate the display of a web page. Penetration testers need to test all client values sent to the web server to determine whether XSS is possible.
Getting ready
Using OWASP Mutillidae II, let’s determine whether the application protects against stored cross-site scripting.
How to do it...
- From the OWASP Mutillidae II menu, select Login by navigating to OWASP 2013 | A3 - Cross Site Scripting (XSS) | Persistent (First Order) | Add to your blog:
Figure 8.9 – Navigation to the stored XSS lesson
- Place some verbiage into the text area. Before clicking the Save...
