Module 14 — Hacking Web Applications · Guided Lab Walkthrough¶
Step-by-step against your own Docker lab (
../../labs/docker-compose.yml) — never a site you don't own. Everything below runs onlocalhost. Each step gives the payload/command, what you should see, an observation, a collapsible hint, and the defender/PAM takeaway. Outputs are representative.
Goal: land XSS by hand (reflected then stored), abuse an IDOR to reach another user's data, then upload a web shell for RCE — and watch each fix shut the attack down. SQL injection has its own drill in Module 15.
Run everything behind an intercepting proxy. Point your browser at Burp Suite or OWASP ZAP (http://127.0.0.1:8080) so every request lands in the proxy history. The proxy is where you understand; automation only confirms.
Targets:
- DVWA at http://localhost:8081 — pages XSS (Reflected), XSS (Stored), File Upload. Grab your PHPSESSID and security cookies (DevTools → Application → Cookies).
- Juice Shop at http://localhost:8082 — modern SPA/API app for the IDOR drill.
Part A — Cross-site scripting: reflected, then stored (DVWA)¶
Set DVWA Security = Low to start.
A1. Reflected XSS on Low¶
On the XSS (Reflected) page, in the What's your name? box submit:
<script>alert(document.domain)</script>
localhost).
Observe: your input was echoed back into the HTML unencoded and the browser executed it. The payload was never stored — it only fired because this request carried it.