Lab · Beginner · 15 min Solved
Reflected XSS
See how a search page that echoes your words as HTML can run unwanted script — only inside the sandbox.
1) The idea
If a site puts your input back into the page as HTML, a crafted tag can run script in that page.
2) Try it
Search for something that calls window.__pwned(), for example an img with an onerror handler.
Hint 1
Think of an HTML tag that can run code when it fails to load.
Hint 2
<img src=x onerror=window.__pwned()>
3) The fix
Escape output (textContent, templating auto-escape). Use a strict CSP that blocks inline handlers. Never use innerHTML with raw input.
Simulated tools. They can only act on this lab's fake target inside the sandbox — there is no target field, no network, and nothing leaves your browser.
XSS payload testerTries HTML/script payloads in the fake search box and detects execution.
$ xss-sim --param q
Recon (headers & forms)Lists the fake target's simulated headers and input fields.
$ recon-sim
Real scanners against real sites without permission are illegal. Use these ideas only on systems you own or are authorized to test.