Share this page!

Harsh Bothra Profile picture
Twitter logo
Mar 28 • 12 tweets • 3 min read
9 Free Practice Labs to Master Cross-Site Scripting
1/
1. PortSwigger XSS Labs
portswigger.net/web-security/c…
2/

2. Google XSS Game

xss-game.appspot.com
3/
3. Alert(1) to Win

alf.nu/alert1?world=a…
4/

4. Prompt(1) to Win

prompt.ml/0
5.

5. XSS Challenges

xss-quiz.int21h.jp
6/
6. cure53 XSS Challenges

github.com/cure53/XSSChal…
7/
7. XSS Gym & XSS Practice Labs by Brutelogic
brutelogic.com.br/gym.php
brutelogic.com.br/knoxss.html
8/

8. XSS by PwnFunction

xss.pwnfunction.com
9/

9. XSS Game

xssgame.com
Missing any important lab from this list? Mention in the comments.
Found this thread useful?

Follow @harshbothra_ for such amazing content on security.

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Harsh Bothra

Harsh Bothra Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @harshbothra_

Harsh Bothra Profile picture
Mar 28
#SecurityExplained S-87: CWE Top 25: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product makes sensitive information available to someone who isn't explicitly permitted to access it.

1/n
2/n
CWE-200 arises when confidential information (e.g., application systems and network information, user-supplied data such as names email addresses) is made available to individuals who are not authorized to see it.
3/n
This flaw could be the outcome of various issues involving the disclosure of sensitive information.

When the following conditions exist, the information is considered sensitive:
Read 9 tweets
Harsh Bothra Profile picture
Mar 27
#SecurityExplained S-86: Vulnerable Code - 65

This code is vulnerable to NoSQL Injection attack.

User-provided data such as URL parameters and POST body content should always be considered untrusted and tainted.

1/n
2/n
 Applications that perform NoSQL operations based on tainted data can be exploited similarly to regular SQL injection bugs. Depending on the code, the same risks exist as with SQL injections: The attacker aims to access sensitive information or compromise data integrity.
3/n
 Attacks may involve the injection of query operators, JavaScript code, or string operations. This problem can be mitigated by using an Object Document Mapper (ODM) library or by validating user-supplied data based on its size or allowed characters.
Read 4 tweets
Harsh Bothra Profile picture
Mar 26
#SecurityExplained S-85: Vulnerable Code - 64

This code is vulnerable to Insecure Deserialization Attack.

User-provided data such as URL parameters, POST data payloads or cookies should always be considered untrusted and tainted.

1/n
2/n
 Deserialization based on data supplied by the user could result in two types of attacks:

Remote code execution attacks, where the structure of the serialized data is changed to modify the behavior of the object being unserialized.
3/n
 Parameter tampering attacks, where data is modified to escalate privileges or change for example quantity or price of products.
The best way to protect against deserialization attacks is probably to challenge the use of the deserialization mechanism in the application.
Read 7 tweets
Harsh Bothra Profile picture
Mar 21
7 Cyber Security Conferences Channel You Must Follow

🧵
1/

1. Black Hat

youtube.com/c/BlackHatOffi…
2/

2. DEFCON Conference

youtube.com/user/DEFCONCon…
Read 9 tweets
Harsh Bothra Profile picture
Mar 14
17 Search Engines every Security Professional Must Know

🧵
1/

1. Shodan - Search Engine for the Internet of Everything

shodan.io
2/
2. Censys Search

search.censys.io
Read 18 tweets
Harsh Bothra Profile picture
Mar 13
#SecurityExplained S-72: Vulnerable Code - 51

This code is vulnerable to SQL Injection attacks.
User-provided data, such as URL parameters, should always be considered untrusted and tainted.

1/n
2/n
 Constructing SQL queries directly from tainted data enables attackers to inject specially crafted values that change the initial meaning of the query itself. Successful database query injection attacks can read, modify, or delete sensitive information from the database ...
3/n
 ...and sometimes even shut it down or execute arbitrary operating system commands. The solution is to use prepared statements and to bind variables to SQL query parameters with dedicated methods like bindParam, which ensures that user-provided data will be properly escaped.
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @harshbothra_ has new unrolls!

Check out other threads from @harshbothra_!

Read all threads by @harshbothra_

:(