Exercise: Cross Side Scripting - XSS

For this first exercise, we will inject into the "Search" field of the page.

• Enter an input such that you open a javascript alert() message.
• Write a javascript file that you position inside your own server. This file contains the command alert.
• Change your input to load your JavaScript file.
• Write a script that creates an alert() message and changes the title of the page.
• Modify your script to remove the error message in the generated page.

Write an HTML e-mail containing a link to your guestbook. The link must contain something like <a href="http://localhost/guestbook/index.php?search=....">Link to the site</a>. The content of the search must be a reflected XSS. It must call the file you wrote in the previous exercise.

Write a Stored-XSS attack (means add a new line in your guestbook that contains this attack) that changes the action of your search form and sends the information to another site that redirects finally to the right page (quite similar to the example for the login in the xss examples page).
Be carreful, some actions have to be done in the future, since the DOM is not finished yet when the javascript is executed.
Be extra carreful in removing the traces of your actions, such that it is not possible to see that the page was modified.