PhpDev.App
moeinfatehi/xss_vulnerability_challenges

moeinfatehi/xss_vulnerability_challenges

Stars: 106

Forks: 12

Pull Requests: 0

Issues: 1

Watchers: 3

Last Updated: 2022-05-25 08:04:59

#application-security #appsecurity #infosec #penetration-testing #pentesting #xss #xss-attacks #xss-detection #xss-exploitation #xss-filter #xss-vulnerability #cross-site-scripting #input-validation #owasp #owasp-top-10 #owasp-top-ten

this repository is a docker containing some "XSS vulnerability" challenges and bypass examples.

License:

Languages: Dockerfile, PHP, CSS, Hack, JavaScript

https://hub.docker.com/r/moeinfatehi/xss_vulnerability_challenges/

Docker Image Size (latest by date) Docker Pulls

XSS Vulnerability Scenarios (challenges)

This repository is a Dockerized php application containing some XSS vulnerability challenges.
The ideas behind challenges are:

  • Javascript validation bypass
  • html entities bypass
  • WAF bypass
  • Black-list validation bypass
  • Basic XSS validation bypass
  • Double encode bypass of WAF to exploit XSS
  • Exploiting XSS by bypassing escape characters

Quick Start Using Docker

Using docker hub (Quickest):

  1. To access the challenges, you need docker installed.
  2. Run this command to pull and run the image from docker hub:
    sudo docker run -d -p 9003:80 moeinfatehi/xss_vulnerability_challenges
  3. Access the challenges with this URL: http://localhost:9003

Help:

-d: detached mode (You can use terminal after running command
-p: specifies port (you can change 8008 to whatever you want. If you don't have a web server on your host, set it to 80)

Using docker-compose:

  1. To access the challenges, you need docker and docker-compose installed.
  2. Clone the repository
    git clone https://github.com/moeinfatehi/xss_vulnerability_challenges.git
  3. Open the main directory of the project (where docker-compose.yml file exists) and run: docker-compose up
  4. Access the challenges with this URL: http://localhost:9003

Disclaimer

This project is for Educational purpose ONLY. The usual disclaimer applies, especially the fact that I'm not liable for any damages caused by direct or indirect use of the information or functionality provided by these programs. The author or any Internet provider bears NO responsibility for content or misuse of these programs or any derivatives thereof. By using these project you accept the fact that any damage (dataloss, system crash, system compromise, etc.) caused by the use of this program is not my responsibility.

Hack and have fun !

If you have any further questions, please don't hesitate to contact me via my twitter account.

OPEN ISSUES

See all

RELEASES

See all