Capture the FlagMedium
Reflected Input
Lab for Cross-Site Scripting (XSS): Turning a Page Against Its Users
Scenario
The search endpoint echoes whatever you searched for back onto the page. If it does that without escaping, an injected tag becomes live markup. Send a test string, then a tag, and see whether the app treats your input as code.
Objective
Prove the search box reflects your input unescaped, the hallmark of reflected XSS.
lab ~ reflected inputnothing real runs
booting lab sandbox…
This sandbox is fully emulated in your browser, nothing real runs and nothing leaves your machine. Type help to see the tools available.