The following is done using the Ubuntu804Server_xsssi Virtual Machine found in the usual place. Once you download and start the VM, it should tell you its IP address. Using this, you should be able to launch a browser on the host machine and connect to the guest webserver. The two important URLs are (assuming you have 10.10.10.129 as an IP address) http://10.10.10.129/sqlInjection http://10.10.10.129/xss For this tutorial, you are to run through the examples, understanding the vulnerabilities both from the outside and from the inside. Run each of the exploits, understanding what they are doing. Finally, login to the server (you should be able to ssh into the server, if you like). Use arnold/password. Then sudo bash, entering password again. You can now take a look at the scripts under /var/www/sqlInjection and /var/www/xss You should understand the issues with the scripts as well as take a look at suggested fixes.