06 / CLIENT-SIDE SECURITY
DVWA Reflected & Stored XSS Assessment
Tested deliberately vulnerable DVWA at Low security and confirmed reflected and stored cross-site scripting, then analyzed the security properties of session identifiers.
Lab environment
Metasploitable2 (192.168.56.107), Ubuntu 24.04 Attackbox (192.168.56.104), VirtualBox Host-only network.
Assessment highlights
- Located DVWA on the Metasploitable2 web root and configured its security level to Low for the exercise.
- Reflected XSS was confirmed because supplied script content was echoed without output encoding.
- Stored XSS persisted in server-side guestbook data and executed again when the page was revisited.
- The captured session cookie demonstrated why session-cookie protections matter in an XSS scenario.
- The report's controlled token experiment showed that predictable sequential identifiers can be recovered quickly, while the observed session identifier was not vulnerable to that specific dictionary technique.
Security impact
XSS can allow attacker-controlled JavaScript to execute in a victim's browser and can expose sensitive client-side data when appropriate cookie protections are absent.
Recommendations
- Apply context-appropriate output encoding.
- Use a Content-Security-Policy as defense-in-depth.
- Set Secure and HttpOnly flags on session cookies.
- Regenerate session IDs after authentication and enforce sensible timeouts.
- Patch or decommission intentionally vulnerable legacy services.
Lab scope: This case study describes coursework performed against intentionally vulnerable systems in an isolated environment.