Learn Pentesting like a Pro!

Share this post

Lab time: Deploying an app prone to Cross-Site Scripting (XSS)

pentesting.academy

Lab time: Deploying an app prone to Cross-Site Scripting (XSS)

Simple and vulnerable NodeJS app deployment with Google Cloud App Engine

pentesting.academy
Oct 6, 2019
Share this post

Lab time: Deploying an app prone to Cross-Site Scripting (XSS)

pentesting.academy

I wrote a little script in node.js for a hands-on lab to test Cross-Site Scripting (XSS).

monitor showing C++
Photo by RoonZ nl on Unsplash

You can download it from my github: https://github.com/defensahacker/nodexss

To deploy in Google Cloud App Engine:

$ git clone https://github.com/defensahacker/nodexss.git
$ gcloud init
$ gcloud projects create xss-lab$RANDOM
$ gcloud config set project xss-lab$RANDOM
$ gcloud projects describe xss-lab$RANDOM
$ gcloud app create --project=xss-lab$RANDOM
$ gcloud app deploy
$ gcloud app logs tail -s default

To start the project from a local system:

git clone https://github.com/defensahacker/nodexss.git
docker build -t defensahacker/nodexss:1.3 --no-cache .
docker run --rm -p 8080:8080 -d defensahacker/nodexss:1.3

Now visit the vulnerable website:

http://localhost:8080/?name=world<script>alert(document.cookie);</script>

Happy hacking!

Thanks for reading Learn Pentesting like a Pro! Subscribe for free to receive new posts and support my work.

Share this post

Lab time: Deploying an app prone to Cross-Site Scripting (XSS)

pentesting.academy
Comments
TopNew

No posts

Ready for more?

© 2023 pentesting.academy
Privacy ∙ Terms ∙ Collection notice
Start WritingGet the app
Substack is the home for great writing