**Requirements**

- Programming Language: JavaScript
- Browsers fundamentals such as Simple request, SameSite, etc

**Objective**
Exploit the CSRF vulnerability to change user's email address. Login with `user:password` credentials and check how forms are submitted and see if you can manipulate the request. Seems the content type is JSON, and the request cannot be CSRFed. Can we be sure about that?

Da Vinci

#### Requirements
+ Programming Language: JavaScript
+ Cross-Origin Resource Sharing (CORS): Filters Bypass

#### Objective
Your goal is to exploit a CORS misconfiguration to steal the admin's `API_KEY`. Begin by logging into the provided credentials and monitoring all HTTP requests. Carefully analyze these requests for potential CORS issues. Conduct tests to identify and exploit the misconfiguration, then craft a malicious link to trick the admin and exfiltrate their `API_KEY`.

#### Credentials:
Admin:
- Username: `voorivex_lab`
- Password: `supersecretpassword`

User:
- Username: `user`
- Password: `user`


GoodCMS

Use the parameter `/?url=URL` to test for open redirect vulnerabilities. You’ll need to bypass the regex filter and closely analyze the **JavaScript** on the page to uncover how the redirection actually works.  

### Requirements  
- **Programming Language**: PHP / JavaScript  
- **Open Redirect**: Regex Bypass

### Objective  
Your goal is to:  
1. **Bypass the regex validation** to input a valid redirect URL.  
2. **Analyze the JavaScript** on the page to understand how it processes other parts of the URL.  
3. Exploit the open redirect vulnerability to redirect the user to an external site successfully.

Easy Door

Your goal is to craft a payload that abuses the `postMessage` functionality to execute arbitrary JavaScript code. Pay attention to:

- Token Generation and Validation: The token is generated each time the page loads, and it’s expected to match the token in incoming messages. Consider if there’s a way to capture or predict the token. Since it’s shared with the parent window, see if there’s an opportunity to manipulate the exchange
- Constructing a Valid Message: If you can obtain the correct token, then crafting a message that includes { `token: <token>, url: <malicious_url>` } might trigger the redirect. Look into methods for observing the initial token or guessing it

PostMessage 3

Analyze the web application for a vulnerable endpoint and craft a payload to execute a DOM-based Cross-Site Scripting (XSS) attack.

#### Requirements
+ Cross-Site Scripting(XSS)
+ Skill: JavaScript Analysis and Payload Crafting


#### Objective
Identify a point in the application's DOM where user input is improperly sanitized, craft a malicious payload.

DOM XSS 1

**Requirements**

- Programming Language: JavaScript
- Browsers fundamentals such as Simple request, SameSite, etc

**Objective**
Exploit the CSRF vulnerability to change administrator's password. Login with `mamad:mamad` credentials and check how forms are submitted and see if you can manipulate the request. Seems the content type is JSON, and the request cannot be CSRFed. Can we be sure about that?

Easy CSRF 2

Easy CSRF 1

Your goal is to craft a payload that abuses the `postMessage` functionality to execute arbitrary JavaScript code. Pay attention to:

- Regex Pattern: The origin regex only allows `sso`, accounts, and `www` subdomains of `voorivex-lab.online`. Look for ways to craft an origin that passes this check but redirects elsewhere
- URL Validation: If you pass the origin check, the `url` in event.data must also be valid. Consider encoded values or unusual structures



PostMessage 4

#### Requirements
+ Programming Language: JavaScript/HTML
+ Cross-Site Scripting (XSS)

#### Objective
Identify an input field or URL parameter where user input is not properly sanitized. Craft an XSS payload to trigger an alert or execute JavaScript within the browser. Your ultimate goal is to exploit this vulnerability and potentially read sensitive information from the page.

XSS Lab 12 - HTML Decode

Your goal is to craft a payload that abuses the `postMessage` functionality to execute arbitrary JavaScript code. Pay attention to:

- Origin Check: Although there is an `e.source !== window.parent` check, it does not validate the actual origin of the message. Think about ways to bypass this check if you can control the origin
- `loadJs` and `initConfig` Commands: The code responds to specific commands, which can be sent with a crafted message. Focus on how you might send a message that includes these types to inject a script or modify configuration settings

PostMessage 2

Your goal is to craft a payload that abuses the `postMessage` functionality to execute arbitrary JavaScript code. Pay attention to:

- Consider how `postMessage` works and how to send a crafted message to trigger this vulnerability
- Think about how `eval` could be exploited to execute any JavaScript code passed in
- Watch for any edge cases where `msgObj` might not be defined as expected

PostMessage 1

#### Requirements
+ Programming Language: JavaScript/HTML
+ Cross-Site Scripting (XSS)

#### Objective
Identify an input field or URL parameter where user input is not properly sanitized. Craft a XSS payload to trigger an alert or execute JavaScript within the browser. Your ultimate goal is to exploit this vulnerability and potentially read sensitive information from the page.

XSS Lab 11 - Black List

XSS Lab 10 - XML

XSS Lab 9 - Scheme

XSS Lab 8 - JS Tricks

XSS Lab 7 - POST Based

XSS Lab 6 - HTML Encode

XSS Lab 5 - Path Based

XSS Lab 4 - Break

XSS Lab 3 - Stored

XSS Lab 2 - DOM Based

XSS Lab 1 - Reflected

#### Requirements
+ Cross-Site Scripting(XSS)
+ Skill: JavaScript Tricks

#### Objective
Find a way to inject a payload using the "javascript:" schema and successfully trigger a POP alert in the application’s DOM environment to complete the challenge.

DOM Schema

گواهینامه شرکت در کلاس، نفراتی که در امتحان شرکت نکردند و یا قبول نشدند این گواهینامه را دریافت کرده‌اند