Thanks to this repo, you'll be able to create a vulnerable VM to perform a simple XSS (Cross-Site Scripting).
The goal of it it to demonstrate and discover what is XSS
The install script has been tested on Debian.
First create a Debian VM. A simple one with no GUI is enough. Just enable ssh.
During installation, create a user. It will be used to set the vulnerable website and it will be automatically deleted at the end.
Once the VM is created, connect to it, and install sudo and git, and give sudo role to the user
ssh myuser@myvm
su -
apt install -y sudo git
adduser myuser sudo
reboot
git clone https://github.com/olivierprotips/XSS-LAB
cd XSS-LAB
chmod +x install.sh
sudo ./install.sh
By default, XSS-LAB is depoyed in automatic mode. It means that users messages are read automatically (to trigger XSS). That way, you can play in standalone.
In case of demonstration, it can be disabled, meaning that you will play the admin. You will have to display the "Read User Messages" to trigger XSS.
To activate the demo mode, after having retrieved the Git Repo :
chmod +x install.sh
sudo ./install.sh demo
Note: it is done at install. Modes cannot be switched after.