Defacing a website means changing its look for anyone who visits the website. It is very common for hacker groups to deface a website to claim that they had successfully hacked it.

Although many other vulnerabilities may be utilized to achieve the same thing, stored XSS vulnerabilities are among the most used vulnerabilities for doing so.

Defacement Elements

We can utilize injected JavaScript code (through XSS) to make a web page look any way we like. However, defacing a website is usually used to send a simple message (i.e., we successfully hacked you), so giving the defaced web page a beautiful look isn't really the primary target.

Four HTML elements are usually utilized to change the main look of a web page:

• Background Color document.body.style.background
• Background document.body.background
• Page Title document.title
• Page Text DOM.innerHTML

We can utilize two or three of these elements to write a basic message to the web page and even remove the vulnerable element, such that it would be more difficult to quickly reset the web page, as we will see next.

Changing Background:

<script>document.body.style.background = "#141d2b"</script> 

Turns background image of the web page to black. OR

<script>document.body.background = "[https://www.hackthebox.eu/images/logo-htb.svg](https://www.hackthebox.eu/images/logo-htb.svg)"</script>

Changing Page Title:

We can change the page title to any title of our choosing, using the document.title JavaScript property, eg

<script>document.title = 'HackTheBox Academy'</script>