XSS guide [PART 1]

[546pvp]

---

XSS Guide [PART 1]

What is XSS? XSS stands for Cross-Site-Scripting. It is usually injected into input fileds or URL.

[ Hidden Content! ]

 
Lets get started! 
We will test exploits on this website.(The website is built for testing XSS. It is legal to test it there.) We can see the input field at the left.
Try to input HTML there and see what happens. It renders the HTML into the website. This is called reflected XSS. 
 

“But how can we make this dangerous?”
BY USING JAVASCRIPT!

Try to input this <= image
 
This payload works by tricking the server to load this image. As you can see, the image has an invalid source and attribute “onerror” which runs JS script which is written after that. You can replace the alert with harmful script that can redirect user or steal their cookies.

I hope you enjoyed guide, leave feedback, corrections and advices in the comments.
Stay Tuned For Part 2  

Not ratedThis leak has not been rated yet, be careful when downloading.