JS Recon Labs

This repository contains labs for JS Recon. The apps in this repository have vulnerabilities to demonstrate the tool's capabilities.

Caution

Do NOT expose these apps to the internet. These are intended to run locally, not in a production environment. If you like to live dangerously, go ahead!

Labs

This repository contains multiple labs with multiple vulnerabilities. All the labs are available as Docker containers, and can be run directly by running the provided commands. Docker will pull the images from Docker Hub and run the containers.

Next.js

• Next.js Fetch App

docker run --rm -p 3000:3000 shriyanss/js-recon-labs:fetch_app

• Next.js Axios App

docker run --rm -p 3000:3000 shriyanss/js-recon-labs:axios_app

• Next.js DOM XSS PostMessage App

docker run --rm -p 3000:3000 shriyanss/js-recon-labs:dom-xss-postmessage

• Next.js DOM XSS PostMessage JS URL App

docker run --rm -p 3000:3000 shriyanss/js-recon-labs:dom-xss-postmessage-jsurl

For users who prefer GitHub Container Registry, they can prepend ghcr.io/ to the image name.

Walkthroughs

Video guides on setting up and solving these labs can be found on JS Recon Site.