1

I have to do a presentation about XSS. I want to give a demo but I can't find test platforms. I found http://zero.webappsecurity.com/index.html but this site always shows a FireHost-block when I try to run a script in the searchbox.

Is there someone who knows the reason for this issue? Does someone have a list of legal XSS vulnerable websites?

| improve this question | |
  • What about a VM? There are many purposely vulnerable VM for testing purposes. – schroeder♦ Jan 20 '15 at 0:54
  • What about xssed.com? – rook Jan 20 '15 at 5:02
  • 2
    I'm voting to close this question as off-topic because it is asking for lists, which can become stale or out-of-date over time. – schroeder♦ Feb 20 '15 at 20:13
  • 1
    I have to agree with Schroeder, the list could easily become outdated. – RoraΖ Feb 20 '15 at 20:37
0

There are many sites on which you can perform the XSS attack. Some sites are demo.testfire.net, hax.tor.hu, hackthissite.org, astalavista.com. You can use demo.testfire.net which is maintained by IBM and is used for Appscan demo.

| improve this answer | |
  • I already tried testfire and it's a very handy site. But the problem is the fact I can't mail the stolen cookie to myself. I don't know the reason why it won't work. I can't even receive an empty mail from it. But my webserver with php does work. It worked on other platforms like bwapp. – Anonymous Jan 20 '15 at 8:43
  • 1
    demo.testfire.net is a demo site which is not connected to any mail server so such attacks cant take place. For showing how the XSS attack occurs you can use a simple payload. – Irfan Jan 20 '15 at 9:00
  • Ow thanks for the info. Do you recommend some VM which works with a mailserver? – Anonymous Jan 20 '15 at 9:01
  • There is no VM as such that has a connection to the mail server( for security purpose). You can use Damn Vulnerable Web Application from OWASP which is a VM and is vulnerable. – Irfan Jan 20 '15 at 9:05
0

Acunetix provides some web applications to test.

Maybe you can use some of them to show XSS on different scenarios: http://www.vulnweb.com/

| improve this answer | |
0

There are special linux distro, such as badstore. It is vulnerable web store. Also damn vulnerable linux provides good web quizzes.

| improve this answer | |
0

you should check out OWASP as it directly relates to your presentation. Specifically to answer your question, you should check out OWASP WebGoat project is its is a deliberately insecure web application designed to teach web app security. (And contains XSS vulns, among many others) You can download it from here: https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project

Additionally, it isn't difficult demonstrate an XSS vulnerability if you have basic programming knowledge. (PHP,ASP,Python). Create a page that asks for input, have it post to a second page that takes that input and displays it back on the page. In php it would be something like this:

index.php:

<? 
   if ( isset($_POST["posted"])) {
       $name = $_POST["name"];
   }

?>
<html>
<body>
<? if (isset($name)) { 
  echo "Hello, <b>" . $name . "</b>";
?>
<form action="index.php" method="post">
<input type="text" name="name" value="">
<input type="hidden" name="posted" value="1">
<input type="submit" name="Submit" value="Submit">
</form>
</body>
</html>
| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.