DVWA——XSS(Reflected)(low)

XSS(Reflected)

interface

Source code

<?php

header ("X-XSS-Protection: 0");

// Is there any input?
if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) {
    // Feedback for end user
    echo '<pre>Hello ' . $_GET[ 'name' ] . '</pre>';
}

?>

Code analysis

          The array_key_exists function checks whether there is a parameter named "name" in the Get parameter, and judges whether the name is empty. If it exists and is not empty, print: Hello name. It can be seen that the legality of the value of name has not been judged, and the name parameter can be constructed to perform xss.

Infiltration step

         Step 1: Enter: in the input field, click submit, you can see the pop-up window.