Lion Cipher Lab
Find and exploit XSS in your own DVWA lab
- Penetration Testing / Red Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Cross-site scripting (XSS) means tricking a website into running an attacker's JavaScript inside another person's browser, in the trusted context of that site. It is one of the most common web vulnerabilities in the world and sits in the OWASP Top 10. Reading about it is not the same as feeling it: until you have typed a payload into a box, watched someone else's browser run your code, and then stolen a session cookie from your own test account, the risk stays abstract. Doing it once — safely, on an app you own — is what turns "XSS is when untrusted input becomes code" from a sentence you…
What you'll learn
- Finding reflected, stored, and DOM-based XSS
- Crafting and testing XSS payloads
- Proving impact (cookie/session theft) in a safe lab
- Reading how output encoding kills an injection
- Working only against targets you own
Steps in this lab
- What XSS is, and its three flavours
- The rule you never break: your own target only
- Stand up the target and set security to Low
- Reflected XSS: bounce a script off the response
- Stored XSS: plant it once, fire it for everyone
- DOM-based XSS: the bug that never reaches the server
- Prove real impact: steal your own session cookie
- Watch the fix win: raise the security level
- What you just learned — offence, then defence