TCL-xss-Labs — An interactive, self-hosted XSS training platform with 33 progressively harder challenges | Kitploit

#	Name	Description
3	Script Tag Blocked	The server strips `<script>` tags. Find another way to execute JavaScript.
4	Attribute Injection	Your input lands inside an HTML attribute. Break out and execute code.
5	JavaScript Context	Your input is placed inside a JavaScript string variable. Escape and inject.
28	Markdown Injection	A naive Markdown renderer converts your post to HTML. Make it execute JavaScript.
32	Filename Injection	Upload a file. The filename is reflected in the UI without sanitization.

#	Name	Description
6	Event Handler Blocklist	Common event handlers are blocked. Find an obscure one the filter missed.
7	Case & Keyword Filter	Aggressive single-pass filter. Use nested keywords to reconstruct them after stripping.
8	DOM-Based XSS	Vulnerability exists entirely in client-side JavaScript reading from the URL.
25	Open Redirect → XSS	Chain an open redirect with a meta-refresh tag to achieve XSS.
27	localStorage DOM XSS	Data stored in localStorage is rendered on reload without sanitization.

#	Name	Description
9	href Injection with Filters	Input goes into an anchor `href` with multiple filters applied.
10	CSP Bypass via JSONP	Bypass Content Security Policy using a same-origin JSONP endpoint.
11	Double Encoding Bypass	Exploit double decoding behavior between WAF and application.
12	Client-Side Template Injection	Template engine evaluates `{{expressions}}` using `eval`.
13	postMessage XSS	Exploit insecure cross-window messaging without origin validation.
14	SVG Upload XSS	Upload SVG files and execute payloads using SVG-specific features.
15	Mutation XSS	Bypass sanitization using browser DOM mutation behavior.
16	Recursive Keyword Filter	Filter loops recursively — use alternative execution contexts.
17	The Polyglot	Payload must execute across HTML, attribute, and JS contexts.
18	DOM Clobbering	Overwrite global variables using crafted HTML elements.
19	Prototype Pollution → XSS	Pollute prototype chain to achieve XSS without direct HTML injection.
20	Base Tag Injection	Inject `<base>` to manipulate resource loading and bypass CSP.
21	Dangling Markup Injection	Exfiltrate sensitive data using only HTML injection (no JS).
22	JSON Injection in Script Block	Escape JSON context inside a nonced script block.
23	URL Scheme Bypass	Bypass filters blocking `javascript:` using encoding tricks.
24	CSS Injection Exfiltration	Use CSS to extract sensitive data without JavaScript.
26	CRLF → Response Splitting	Inject headers to split HTTP response and inject HTML.
29	iframe Sandbox Escape	Escape insecure iframe sandbox configurations.
30	AngularJS Sandbox Escape	Exploit AngularJS expression sandbox bypass techniques.

1	Hello, Reflected XSS	No filters, no encoding. Your input is reflected directly into the page.
2	Stored XSS Guestbook	Your input is stored and rendered for all visitors. Classic persistent XSS.

TCL-xss-Labs

Most Popular

🟡 Medium

🔴 Hard

⚫ Expert

Getting Started (Local)

Run with Docker (Recommended)

Features

How It Works

Learning Path

Requirements

Disclaimer

Final Note

TCL-xss-Labs

Most Popular

XSS Lab — The Cyber Ledger

Challenges

🟢 Easy

🟡 Medium

🔴 Hard

⚫ Expert

Getting Started (Local)

Run with Docker (Recommended)

Features

How It Works

Learning Path

Requirements

Disclaimer

Final Note