XSS 漏洞练习靶场，覆盖反射型、存储型、DOM 型、SVG、CSP、框架注入、协议绕过等多种场景

工具介绍

XSS-Sec 靶场项目是一个以"实战为导向"的 XSS 漏洞练习靶场，覆盖反射型、存储型、DOM 型、SVG、CSP、框架注入、协议绕过等多种场景。页面样式统一，逻辑清晰，适合系统化学习与教学演示。

关卡总览（名称与简介）

Level 1: Reflected XSS --- The basics.
Level 2: DOM-based XSS --- Client-side manipulation.
Level 3: Stored XSS --- Persistent payloads.
Level 4: Attribute Breakout --- Escape the attribute.
Level 5: Filter Bypass --- No allowed.
Level 6: Quote Filtering --- Break out of single quotes.
Level 7: Keyword Removal --- Double write bypass.
Level 8: Encoding Bypass --- HTML entities are your friend.
Level 9: URL Validation --- Must contain http://
Level 10: Protocol Bypass --- Case sensitivity matters.
Level 11: JS Context --- Break out of JS string.
Level 12: DOM XSS via Hash --- The server sees nothing.
Level 13: Frontend Filter --- Bypass the regex.
Level 14: Double Encoding --- Double the trouble.
Level 15: Framework Injection --- AngularJS Template Injection.
Level 16: PostMessage XSS --- Talk to the parent.
Level 17: CSP Bypass --- Strict CSP? Find a gadget.
Level 18: Anchor Href XSS --- Stored XSS in href.
Level 19: DOM XSS in Select --- Break out of select.
Level 20: jQuery Anchor XSS --- DOM XSS in jQuery attr().
Level 21: JS String Reflection --- Reflected XSS in JS string.
Level 22: Reflected DOM XSS --- Server reflection + Client sink.
Level 23: Stored DOM XSS --- Replace only once.
Level 24: WAF Bypass (Tags/Attrs) --- Reflected XSS with strict WAF.
Level 25: SVG Animate XSS --- SVG-specific vector bypass.
Level 26: Canonical Link XSS --- Escaping single quotes issue.
Level 27: Stored XSS in onclick --- Entities vs escaping pitfall.
Level 28: Template Literal XSS --- Reflected into JS template string.
Level 29: Cookie Exfiltration --- Stored XSS steals session cookie.
Level 30: Angular Sandbox Escape --- No strings, escape Angular sandbox.
Level 31: AngularJS CSP Escape --- Bypass CSP and escape Angular sandbox.
Level 32: Reflected XSS (href/events blocked) --- Bypass via SVG animate to set href.
Level 33: JS URL XSS (chars blocked) --- Reflected XSS in javascript: URL with chars blocked.
Level 34: CSP Bypass (report-uri token) --- Chrome-only CSP directive injection via report-uri.
Level 35: Upload Path URL XSS --- Independent lab: upload HTML, random rename, URL concat XSS.
Level 36: Hidden Adurl Reflected XSS --- Independent lab: hidden ad anchor reflects adurl/adid.
Level 37: Data URL Base64 XSS --- Blacklist filter; must use data:text/html;base64 in object.
Level 38: PDF Upload XSS --- Independent lab: upload PDF, view opens HTML-in-PDF causing XSS.
Level 39: Regex WAF Bypass --- src/="data:..." bypasses WAF regex.
Level 40: Bracket String Bypass --- href reflects; use window $"al"+"ert"$ to evade WAF.
Level 41: Fragment Eval/Window Bypass --- Echo HTML; split strings then eval or window $a+b$ .
Level 42: Login DB Error XSS --- Independent lab: invalid DB shows error, SQL reflects username.
Level 43: Chat Agent Link XSS --- Independent lab: chat echoes, agent clicks user link executes.
Level 44: CSS Animation Event XSS --- Strong WAF: only @keyframes+xss onanimationend allowed.
Level 45: RCDATA Textarea Breakout XSS --- Strong WAF: only textarea/title RCDATA breakout works.
Level 46: JS String Escape (eval) --- theme string injection; escape with eval(myUndefVar); alert(1);
Level 47: Throw onerror comma XSS --- Strong WAF: only throw οnerrοr=alert,cookie
Level 48: Symbol.hasInstance Bypass --- Strong WAF: only instanceof+eval chain
Level 49: Video Source onerror XSS --- Strong WAF: only video source onerror
Level 50: Bootstrap RealSite XSS --- Independent site: only xss onanimationstart

工具下载

复制代码

https://github.com/duckpigdog/XSS-Sec