Prove XSS impact on your own app without harming a user

short · 55 min · Objective 4.4

Task

Find reflected, stored and DOM-based XSS in a weak application you built, prove impact without a payload that harms a real user, and fix it with output encoding and a content security policy — seeing where each control's limits are.

Steps

  1. On the lab you own, run an application with three planted flaws: a value reflected into the page, a value stored and rendered later, and one handled by client-side script.
  2. Confirm each by a harmless proof — a payload that pops a marker or writes to the page, never one that steals a real session or targets a real person.
  3. Classify each as reflected, stored or DOM-based, and note what an attacker actually gains from execution in the page.
  4. Apply output encoding and confirm the reflected and stored cases are neutralised.
  5. Add a content security policy and note what it does and does not cover — the DOM-based case may need a code fix, not a header.
  6. Record the limits of each control.

Verify

grep -ciE "reflected|stored|dom-based" /tmp/xss.md
grep -ciE "marker|harmless|no real|alert.?1|benign" /tmp/xss.md
grep -ciE "encoding|csp|content security|limits|code fix" /tmp/fix.md

The first count must be non-zero: you classified the three XSS types. The second must be non-zero: your proofs were harmless markers, never anything that harms a real user. The third must be non-zero: you applied encoding and CSP and recorded their limits — output encoding neutralises reflected and stored, and a CSP helps but does not fix a DOM sink on its own.

Notes

Prove impact without a payload that harms a real user — a marker in your own page demonstrates execution as well as a stolen session, without the harm. Output encoding is the primary fix; a content security policy is defence in depth with real limits, and DOM-based XSS often needs a code change rather than a header. Everything ran on an application you built, and no real user was targeted.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.