Web Application Hacking (Hands-On)
Cross-Site Scripting (XSS) — Concept + Live Lab
Inject JavaScript that runs in a victim's browser. Pop it live in the lab.
Open the interactive lesson & lab →
XSS happens when an app reflects or stores user input into a page without escaping it, so your input is parsed as HTML/JavaScript and executes in other users' browsers.
The three types
- Reflected — payload in the URL/request is echoed back immediately (the lab below).
- Stored — payload is saved (e.g. a comment) and fires for every visitor. Most dangerous.
- DOM-based — client-side JS writes attacker input into the page unsafely.
Payloads to try in the lab
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg onload=alert(document.domain)>Real impact goes far beyond alert(): stealing session cookies, keylogging, or performing actions as the victim. alert() is just proof the code executed.