Skip to main content

Stored XSS

Lab: DVWA
Scenario: Stored Cross-Site Scripting
Difficulty: Intermediate
Estimated Time: 30 minutes

Learning Objectives​

By the end of this scenario, you will be able to:

  • Understand the difference between reflected and stored XSS
  • Identify stored XSS vulnerabilities
  • Exploit stored XSS attacks
  • Understand the persistent nature of stored XSS

Setup​

Prerequisites​

  • DVWA lab running at CSN Labs
  • Web browser (Chrome/Firefox recommended)
  • Security level set to "Low"

Initial Configuration​

  1. Log into DVWA
  2. Set security level to "Low"
  3. Navigate to "Stored XSS" module

Scenario Story​

You are testing a web application's message board or comment system. The application stores user input in a database and displays it to other users. Your goal is to understand how stored XSS works and its impact.

Step-by-Step Walkthrough​

This scenario walkthrough will be completed with detailed steps.

Why This Works​

Stored XSS occurs when malicious scripts are permanently stored on the server (e.g., in a database) and executed when other users view the stored content.

Defender Notes​

How to Detect​

  • Monitor database for script tags and malicious content
  • Scan stored content for XSS patterns
  • Review user-generated content before display

How to Prevent​

  1. Input Sanitization: Sanitize all user input before storing
  2. Output Encoding: Encode content when displaying
  3. Content Security Policy: Implement CSP headers
  4. Regular Audits: Review stored content for malicious scripts

Try These Variations​

Easy​

  • Store different XSS payloads
  • Test with various HTML tags

Medium​

  • Attempt to bypass sanitization filters
  • Test persistent attacks across sessions

Hard​

  • Try advanced encoding and obfuscation
  • Attempt to chain with other vulnerabilities

Evidence Checklist​

Capture screenshots of:

  • Input form for storing content
  • Stored malicious script
  • Script execution when viewed by another user

Next Steps​