I am learning web application security testing; specifically XSS. With so many web app programs, I wonder which is easiest to setup/configure, which is easiest to learn XSS, and which application the InfoSec community prefers? Thanks in advance

closed as primarily opinion-based by Arminius, tlng05, Stephane, Serge Ballesta, schroeder Jun 14 '17 at 10:51

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Unfortunately, product recommendations are off-topic. – Arminius Jun 13 '17 at 21:03

OWASP's security shepherd is really good for learning, and you can configure it to only show challenges for specific types of vulnerabilities if XSS is all you're focusing on right now. You can download a VM here and get it up and running in less than 10 minutes. If you're looking for less structure, there's BeeBox, which has pages where you can play around with vulnerabilities at different difficulty levels. That can be downloaded here.


Damn Vulnerable Web Application is a good place to start exploiting common vulnerabilities in a controlled environment. You can play with multiple vulnerabilities (which are part of OWASP Top 10) such as XSS, SQL injection, CSRF, command execution... It is fairly easy to install: the process is detailed in the README file.

Not the answer you're looking for? Browse other questions tagged or ask your own question.