Cross-Site Scripting (XSS)

This paper discusses what is Cross-Site Scripting (XSS) and what can it do when the attack is launched successfully. A Cross-Site Scripting attack is a well-known attack that is used by hackers to attack web applications for many purposes but mostly is used to steal confidential information from the client or the database of the webserver. There will be a demonstration on how to perform cross-site scripting attack with several tools such as XSSer, FoxyProxy and Burp Suite. The whole demonstration is performed by using a virtual machine with Kali Linux Operation System and the target web application is a buggy web application that is used to perform penetration testing named, bWAPP. This demonstration shows how easy is the cross-site scripting attack can be performed in just a few steps in a few minutes. Besides the demonstration of cross-site scripting attack, there will also have some introduction to the tools used in the demonstration such as XSSer, FoxyProxy and Burp Suite. There will also be a discussion on the result of the cross-site scripting attack demonstration and the countermeasure against this kind of attack to avoid people falling into the cross-site scripting attack easily in this paper.