Reflected XSS Mitigation and URL Encoding
In this lab you will learn how to control and bypass a reflected Cross-Site Scripting (XSS) vulnerability. You will learn why you need to encode URL characters. You will also learn how the str_ireplace function can be used to disallow some SCRIPT elements from executing. However, it will not disallow all SCRIPT elements.
outcomes:
In this lab, you will learn to:
- Understand why URL encoding is important.
- Implement a security control for reflected XSS vulnerability.
- Bypass the implemented security control.
VIDEOS:
Before you start this lab, review these videos.
Overview
In this lab, we are going to demonstrate why we encoded the SCRIPT element when defining the myusername variable inside of the browser. We will also implement a security control that will mitigate the reflected XSS attack in the Reflected XSS lab. Your pentesting assignment will be to bypass the security control.
Reflected XSS Mitigation and URL Encoding