Applications vulnerability

The objective of the task is to practice Cross-Site Scripting (XSS) attacks and how to prevent them.

In the role of an attacker, you will find a website vulnerability to XSS attacks, disguise malicious code in a URL, and use a phishing email to lure the victim into the attack. You will perform an analysis of the attack flow and fix the XSS vulnerability in the source code of the website.

What you will learn:

• finding website vulnerabilities,
• disguising malicious code in a URL,
• analyzing the flow of XSS attacks,
• removing website vulnerabilities.

The ongoing tasks are:

• identifying the direction of a possible attack,
• creating a malicious URL and disguising the attack,
• creating and sending a phishing message (email),
• performing the attack,
• analysis from the victim's side,
• fixing the website, verifying security.

The following workstations are available for this task:

• User (attack victim) – Windows OS
• Attacker – Kali OS
• Web server host – Ubuntu OS

The estimated time for the laboratory task is approximately 70 minutes.