Older Challenges & Write-Ups

The following list is meant to provide links to all past XSS challenges and the respective write-ups. Some of them are already closed but still allow to play with the code, others might be down already and already offer a write-up. Please let us know if one of the links here is down.

• @filedescriptor's Challenges and Puzzles
  • http://kcal.pw/puzzle.php
  • http://kcal.pw/puzzle2.php
  • http://kcal.pw/puzzle3.php
  • http://kcal.pw/mini-puzzle.php
  • http://kcal.pw/mini-puzzle2.php
  • http://prompt.ml
• Mario and Krzysztof Kotowicz's "So you think you can dance?"
  • http://kotowicz.net/java/java.html
• @steike's "alert(1) to win"
  • http://escape.alf.nu/
  • http://www.pwntester.com/blog/2014/01/06/escape-alf-nu-xss-challenges-write-ups-part-148/
  • http://www.pwntester.com/blog/2014/01/08/escape-alf-nu-xss-challenges-write-ups-part-257/
• ZDResearch XSS challenge
  • https://zdresearch.com/zdresearch-xss1-challenge-writeup/
• Gareth's Hackvertor XSS Challenges
  • http://challenge.hackvertor.co.uk/?challenge
• Soroush Dallili's XSS Challenge series
  • https://soroush.secproject.com/blog/2012/04/secproject-web-appsec-challenge-series-1/
• Google XSS Challenge
  • https://xss-game.appspot.com/
  • http://blog.dornea.nu/2014/06/02/googles-xss-game-solutions/
• XSS Challenge by Krzysztof Kotowicz
  • http://kotowicz.net/shoutbox/shoutbox.php
• Blacklist WAF Bypass Challenge 1
  • https://hack.me/101575/bypass-blacklist-based-waf-challenge.html
• Blacklist WAF Bypass Challenge 2
  • https://hack.me/101705/rhainfosec-xss-challenge-2.html
  • http://d.hatena.ne.jp/masa141421356/20140617/1403016848
• @avlidienbrunn XSS challenge 1
  • http://avlidienbrunn.se/xsschallenge/
  • http://avlidienbrunn.se/xsschallenge/solvers.txt
• @avlidienbrunn XSS challenge 2
  • http://avlidienbrunn.se/xsschallenge2
• Cure53 Easter Challenge '13
  
  • http://cure53.de/easter/
  • http://cure53.de/easter-writeup/
• Cure53 Cookie Challenge
  • http://heideri.ch/biscuit/
  • http://heideri.ch/biscuit/results
• Cure53 Xmas Challenge 2010
  • http://heideri.ch/xmas2
• Mario's XSSMe Challenge
  • http://html5sec.org/xssme.php
  • http://xssme.html5sec.org/xssme2?xss=
  • http://d.hatena.ne.jp/masa141421356/20120612
• Roman's crazy hard XSS Challenge Number 1
  • http://xss-shafigullin-pro.appspot.com/s01
• Roman's crazy hard XSS Challenge Number 2
  • http://xss-shafigullin-pro.appspot.com/s02.html
• mala's jQuery-related XSS challenge
  • http://ma.la/xssq/q.cgi
• @webtonull XSSMas Challenge
  • http://research.insecurelabs.org/xssmas/
  • http://research.insecurelabs.org/xssmas/solutions.html
• @webtonull XSS Challenge
  • http://research.insecurelabs.org/helmet.js/
• Cure53 Singapore-Training Challenge
  • https://github.com/cure53/xss-challenge-wiki/wiki/Cure53-Singapore-Training-Challenge
• And even more challenges...
  • http://pagebox.herokuapp.com/
  • http://www.businessinfo.co.uk/labs/jslr/jslr.php
  • http://blog.spiderlabs.com/2013/09/modsecurity-xss-evasion-challenge-results.html
  • http://xssgame.vulnerable.pl/index.php
  • http://www.domxss.com/domxss/domxss.php