Skip to main content

XSS Session

What is XSS?​

Cross-Site Scripting (XSS) lets attackers run JavaScript in your browser within the app's context. Same origin = access to your cookies, session tokens, and actions.

Why it matters: Account takeover, data theft, defacement.

The 3 Types (same root cause: unsanitized input)​

Reflected XSS​

Payload in URL/search → server reflects it back immediately → executed in browser.

  • Needs victim to click link
  • Example: search for <script>alert(1)</script> → result page shows your input without encoding

Stored XSS​

Payload saved in database → executes for every later visitor.

  • Higher impact (affects all users)
  • Example: submit feedback with <img src=x onerror=alert(1)> → executes every time admin reads it

DOM-based XSS​

Pure client-side. JavaScript reads user input (URL param, localStorage) and writes to DOM without sanitizing.

  • No server roundtrip
  • Example: search bar JS uses innerHTML to display results

Challenge Order (Juice Shop)​

Work through in this order. Each builds on previous.

Challenge 1: DOM XSS ⭐​

Location: Search bar
Type: DOM-based
What to do:

  1. Type in search bar
  2. Observe: your input appears in page + URL
  3. Try injecting HTML: search for <b>test</b> — does it bold?
  4. If yes, try: <img src=x onerror=alert('xss')>
  5. Open DevTools Elements tab, find where your input landed

Success criteria: Alert fires. You can point to the sink (innerHTML or similar) in DevTools.

Challenge 2: Bonus Payload ⭐​

Location: Same search bar
Type: DOM filter bypass
What to do:

  1. Certain tags are blocked now (if you already solved DOM XSS, the vector changed)
  2. Try alternatives: <svg>, <iframe>, event handlers like onerror, onload
  3. Experiment: what gets through the filter?

Success criteria: Different payload fires. You know which filter you bypassed.

Challenge 3: Reflected XSS ⭐⭐​

Location: Order history / tracking
Type: Reflected
What to do:

  1. Find a page that takes input (search, order ID, tracking number)
  2. Submit a value
  3. Observe where it appears on result page
  4. Try injecting: <img src=x onerror=alert('xss')>
  5. Burp Suite or DevTools Network tab: capture request, see what you sent

Success criteria: Alert fires on result page. You can see your payload in request/response.

Tools You Need​

  • Browser DevTools (DevTools → Network, Elements, Console tabs)
  • Burp Suite Community or OWASP ZAP (intercept + modify requests)
  • Patience + note-taking

What NOT to Do​

  • Do not read Juice Shop source code
  • Do not use the hacking instructor (disable it)
  • Do not look up solutions before trying
  • Do not modify DB directly

Homework (after session, 5 min write-up)​

For each challenge you solve:

  • Challenge name
  • How you found it (what tool, what clue)
  • Time spent (start → solved)
  • Dead ends (what didn't work)

This becomes your baseline for comparing manual vs AI approaches later.