Cross-site scripting labs for web application security enthusiasts ### List of Chall :
~ Chall 1 | URL ~ Chall 2 | Form ~ Chall 3 | User-Agent ~ Chall 4 | Referrer ~ Chall 5 | Cookie ~ Chall 6 | LocalStorage ~ Chall 7 | Login Page ~ Chall 8 | File Upload ~ Chall 9 | Base64 Encoding ~ Chall 10 | Removes Alert ~ Chall 11 | Removes Script ~ Chall 12 | Preg_replace ~ Chall 13 | HTML Entities ~ Chall 14 | Regex Filter #1 ~ Chall 15 | Regex Filter #2 ~ Chall 16 | Regex Filter #3 ~ Chall 17 | HTML Entities + URL Encode ~ Chall 18 | HTML Entities #2 (Special Character) ~ Chall 19 | HTML Entities #3 (Input Value) ~ Chall 20 | HTML Entities #4 (Input Value + Capitalizes)### Screenshot : 
 ### Instalation :
- Run your web server (XAMPP / LAMPP)
- Clone the repository and put the files in the /htdocs/xss-labs
- You can akses http://localhost:8080/xss-labs
- Happy Hacking ^_^
跨站脚本攻击实验室：0l4bs (https://zhuanlan.zhihu.com/p/108023848)
0l4bs XSS实验 (https://icssec.club/2020/02/25/0l4bs-XSS/)
Kitploit (https://www.kitploit.com/2020/02/0l4bs-cross-site-scripting-labs-for-web.html?m=0) ### Support our organization by giving donations [](https://paypal.me/dalpan) ================================================ FILE: chall/1.php ================================================
Cross-site scripting labs for web application security enthusiasts
Chall 1 — Clue : URL
Value : ";
if(isset($_GET['status'])) {
$status = $_GET['status'];
echo $status;
}
?>
Happy hacking ^_^
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 10 — Clue : Removes Alert
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 11 — Clue : Removes Script
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 12 — Clue : preg_replace
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 13 — Clue : HTML Entities
','>', $status);
echo $status;
}
?>
Happy hacking ^_^
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 14 — Clue : Regex Filter #1
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 15 — Clue : Regex Filter #2
Hello, " . $name . "
";
}
else{
echo '';
}
?>
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 16 — Clue : Regex Filter #3
]+?[\x00-\x20"\'])(?:on|xmlns)[^>]*+>#iu', '$1>', $status);
// Remove javascript: and vbscript: protocols
$status = preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2nojavascript...', $status);
$status = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2novbscript...', $status);
$status = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u', '$1=$2nomozbinding...', $status);
// Only works in IE:
$status = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#i', '$1>', $status);
$status = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#i', '$1>', $status);
$status = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#iu', '$1>', $status);
// Remove namespaced elements (we do not need them)
$status = preg_replace('#]*+>#i', '', $status);
$status = preg_replace('#]*+>#i', '', $status);
echo $status;
}
?>
Happy hacking ^_^
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 17 — Clue : HTML Entities + URL decode
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 18 — Clue : HTML Entities (Special Character)
Hello, " . htmlspecialchars($name) . "
";
}
else{
echo '';
}
?>
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 19 — Clue : HTML Entities on HTML input value
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 2 — Clue : Form
Hello, " . $_POST['fname'] . "
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 20 — Clue : HTML entities, HTML input value + capitalizes all characters
"; } ?>
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 3 — Clue : User-Agent
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 4 — Clue : Refferer
";
echo utf8_decode(urldecode($_SERVER['HTTP_REFERER']));
}
?>
Happy hacking ^_^
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 5 — Clue : Cookie
Current value supplied by labs-tegal1337 cookie is:
" . (string)$_COOKIE['labs-tegal1337'] . ''; } ?>
Happy hacking ^_^
" . (string)$_COOKIE['labs-tegal1337'] . ''; } ?>
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 6 — Clue : LocalStorage
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
' . $_GET['message'] . '
';
echo $status;
}
?>
You are logged in as ' . $_SESSION['username'] . '';
echo 'Logout'; } else{ echo ''; } ?>
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 8 — Clue : File Name
Pilih File :
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Chall 9 — Clue : Base64 Encoding
Happy hacking ^_^
|
Cross-site scripting labs for web application security enthusiasts
Congratulations on completing this challange
^_^
Regards
Tegal1337 Team
^_^
Regards
Tegal1337 Team
Cross-site scripting labs for web application security enthusiasts
Welcome to XSS Labs | Tegal1337 — Type help for a list of supported commands.
➜ ~
~ Chall 1 | URL
~ Chall 2 | Form
~ Chall 3 | User-Agent
~ Chall 4 | Referrer
~ Chall 5 | Cookie
~ Chall 6 | LocalStorage
~ Chall 7 | Login Page
~ Chall 8 | File Upload
~ Chall 9 | Base64 Encoding
~ Chall 10 | Removes Alert
~ Chall 11 | Removes Script
~ Chall 12 | Preg_replace
~ Chall 13 | HTML Entities
~ Chall 14 | Regex Filter #1
~ Chall 15 | Regex Filter #2
~ Chall 16 | Regex Filter #3
~ Chall 17 | HTML Entities + URL Encode
~ Chall 18 | HTML Entities #2 (Special Character)
~ Chall 19 | HTML Entities #3 (Input Value)
~ Chall 20 | HTML Entities #4 (Input Value + Capitalizes)
', about: 'XSS Labs | Tegal1337
Cross-site scripting labs for web application security enthusiasts,
This website is made for practice, please dont hack', join: 'Lets contribute with us, just enter your github username via email contact@dalpan.co with subject "JOIN Tegal1337"', resume: "resume.pdf", experience: "No Experience😥", contact: "You can contact us on any of following links:
Facebook ,Instagram", labs: "" }; let userInput, terminalOutput; const app = () => { userInput = document.getElementById("userInput"); terminalOutput = document.getElementById("terminalOutput"); document.getElementById("dummyKeyboard").focus(); console.log("Application loaded"); }; const execute = function executeCommand(input) { let output; input = input.toLowerCase(); if (input.length === 0) { return; } output = `
➜ ~ ${input}
`;
if (!COMMANDS.hasOwnProperty(input)) {
output += `no such command: ${input}
`;
console.log("Oops! no such command");
} else {
output += COMMANDS[input];
}
terminalOutput.innerHTML = `${
terminalOutput.innerHTML
}${output}
`;
terminalOutput.scrollTop = terminalOutput.scrollHeight;
};
const key = function keyEvent(e) {
const input = userInput.innerHTML;
if (BLACKLISTED_KEY_CODES.includes(e.keyCode)) {
return;
}
if (e.key === "Enter") {
execute(input);
userInput.innerHTML = "";
return;
}
userInput.innerHTML = input + e.key;
};
const backspace = function backSpaceKeyEvent(e) {
if (e.keyCode !== 8 && e.keyCode !== 46) {
return;
}
userInput.innerHTML = userInput.innerHTML.slice(
0,
userInput.innerHTML.length - 1
);
};
document.addEventListener("keydown", backspace);
document.addEventListener("keypress", key);
document.addEventListener("DOMContentLoaded", app);