XSS Labs

🔴 Reflected XSS

Exploit innerHTML injection via URL query parameter. No sanitization applied.

🔴 Stored XSS

Submit malicious input through a comment form that gets stored and reflected on the page.

🔴 DOM-based XSS

Inject JavaScript through the URL fragment (#) that is written to the DOM without sanitization.

🔴 Reflected XSS

Angle Brackets HTML-Encoded - Break Out of Attribute

🔴 Stored XSS

Inject malicious scripts through user profile fields that persist across sessions.

🔴 Reflected XSS

Demonstrates how search queries can be exploited to inject malicious scripts.

🔴 Reflected XSS

Demonstrates how the Referer header can be exploited to inject malicious scripts.

🔴 Reflected XSS

Demonstrates how image upload functionality can be exploited to inject malicious scripts.

🔴 Stored XSS

Demonstrates how a chat application can be exploited to inject malicious scripts.

💡 Tips for Solving XSS Labs

Use the browser's developer tools (F12) to inspect the DOM and see how your input is reflected.
Try different payloads and encoding techniques to bypass filters.
Check the console for any errors or warnings that might give hints.
Remember to test both GET and POST parameters, as well as headers.