🧪 OWASP Top 10 Lab — Stored Cross Site Scripting (XSS)

Category: A05:Injection

🧠 Vulnerability Type

• Stored Cross Site Scripting (Persistent XSS)
• Client-side injection
• Untrusted input rendered without encoding

🎯 Objective

Demonstrate a Stored Cross Site Scripting (Persistent XSS) vulnerability using DVWA by injecting malicious JavaScript that executes for all users viewing stored content.

🛠 Lab Environment

• DVWA (Docker)
• Kali Linux
• Browser testing
• Security Level: Low

💉 Payload Used

<script>alert('Stored XSS')</script>

👣 Steps to Reproduce

1. Navigate to DVWA → Stored XSS module
2. Enter attacker name and payload in message field
3. Submit the form
4. Reload the page or revisit as another user
5. Observe JavaScript execution

💥 Impact

• Session hijacking
• Credential theft
• Account takeover
• Malicious script execution for all users

🧪 Proof of Concept

The injected payload is stored in the application database and executed whenever the vulnerable page renders stored content.

Payload Injection

JavaScript Execution Popup

Stored Entries in Guestbook

🛡 Mitigation

• Output encoding (HTML escaping)
• Input sanitization
• Content Security Policy (CSP)
• Framework auto-escaping

🧠 Key Learning

Stored XSS is significantly more dangerous than reflected XSS because payloads persist in the application and affect every user who loads the page. Proper output encoding is critical to prevent injection attacks.

🐺 Personal Note

This lab demonstrates real-world persistent XSS behavior commonly seen in comment systems, ticketing portals, and admin dashboards. Understanding stored XSS is foundational for modern bug bounty hunting.