Scribd
Upload
62 views

© 2020 Caendra Inc. - Hera For Waptxv2 - Xss Labs

Uploaded by

Saw Gyi
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
62 views

© 2020 Caendra Inc. - Hera For Waptxv2 - Xss Labs

Uploaded by

Saw Gyi
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

1

© 2020 Caendra Inc. | HERA for WAPTXv2 | XSS Labs


GETTING STARTED

1. Warm-up: XSS level 1


2. Easy: XSS level 2
3. Easy: XSS level 3
4. Easy: XSS level 4
5. Medium: XSS level 5
6. Medium: XSS level 6
7. Medium: XSS level 7
8. Hard: XSS level 8
9. Hard: XSS level 9
10.Hard: XSS level 10
11.Hard: XSS level 11

The Find Me! labs do not need any introduction!


Each level generates HTML in an unsafe way, and you have to bypass some
server-side PHP filters.
The solutions you will see are just a few of the many you can have.
As a suggestion, once you will finish these labs, you can try to solve them again
using your way and alternative techniques.
The full list of all the labs and the related descriptions are available at:
http://info.xss.labs/

© 2020 Caendra Inc. | HERA for WAPTXv2 | XSS Labs


GETTING STARTED

The main goal of these labs is to create a PoC triggering an alert box like this one:
alert('l33t');

If the exploitation has performed successfully, you'll see something like this:

Of course, it must be executed without user interaction.

The best tool is, as usual, your brain. You may also need:
• Web Browser GETTING STARTED
• HTTP Proxy
• Local/Remote server web

The techniques to use during this lab are better explained in the study material.
You should refer to it for further details. These solutions are provided here only
to verify the correctness.
The solution files are available at http://info.xss.labs/solutions.

© 2020 Caendra Inc. | HERA for WAPTXv2 | XSS Labs

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy