⚠ FOR SECURITY TESTING PURPOSES ONLY — DO NOT DEPLOY IN PRODUCTION
XSS
Cross-Site Scripting
Three XSS vectors: reflected (output echoed from input), stored (persisted to comment list), and DOM-based (innerHTML injection). All inputs are intentionally unsanitized.
> Show hints
- [1] <script>alert(1)</script>
- [2] <img src=x onerror=alert('xss')>
- [3] <svg onload=alert(document.cookie)>
[1] Reflected XSS
Input is reflected directly into the page without sanitization.
[2] Stored XSS
Comments are stored and rendered without sanitization.
admin
Welcome to the XSS lab. Try injecting a script tag.
[3] DOM-Based XSS
Input is written directly to the DOM via innerHTML. No server round-trip.
DOM output: