Writeups
-
Easy
Reflected XSS into a JavaScript string with angle brackets HTML encoded
Reflected XSS where the search term is reflected inside a JavaScript string and angle brackets are encoded, solved by breaking out of the string with a quote and using '-alert(1)-' to force the alert to run
Cross-site scripting (XSS) 3 min -
Easy
Stored XSS into anchor href attribute with double quotes HTML-encoded
Stored XSS where the comment author website becomes an anchor href and double quotes are HTML encoded, solved by storing a javascript: URL
Cross-site scripting (XSS) 4 min -
Easy
Reflected XSS into attribute with angle brackets HTML-encoded
Reflected XSS where the search term is echoed into a quoted value attribute and angle brackets are HTML encoded
Cross-site scripting (XSS) 4 min -
Easy
DOM XSS in jQuery selector sink using a hashchange event
DOM XSS where location.hash flows into jQuery's $() selector, solved by framing the lab and mutating the iframe hash on load so a hashchange builds an img tag whose onerror calls print()
Cross-site scripting (XSS) 5 min -
Easy
DOM XSS in jQuery anchor href attribute sink using location.search source
DOM XSS through a jQuery href sink where the returnPath value from location.search lands in the back link
Cross-site scripting (XSS) 3 min -
Easy
DOM XSS in document.write sink using source location.search
search term is read straight from location.search and written raw into an img src attribute via document.write
Cross-site scripting (XSS) 4 min -
Easy
Stored XSS into HTML context with nothing encoded
stored XSS lab where a blog comment is saved as is and rendered back with zero encoding on every visit.
Cross-site scripting (XSS) 1 min
Nothing matched that.
No writeups here yet. Try a broader tag, or clear the filter to see everything.
Clear filters