XSS Practice Pack
A single-topic practice pack for CWAP Module 03: Cross-Site Scripting. Each mini-lab below is isolated and drills XSS and nothing else.
Naked labs
Minimal UI, one or two features, exactly one exploitable sink each. No hunting - the bug is right where you look. Learn one context at a time.
- ⬜ reflected-bodynaked
One search box; your input is echoed straight into the page body. - ⬜ reflected-attrnaked
Your input is placed inside a double-quoted attribute value. - ⬜ storednaked
A one-field guestbook renders saved entries to the next visitor. - ⬜ dom-hashnaked
Client-side JS copies the URL #fragment into the page (innerHTML). - ⬜ filter-bypassnaked
A naive filter deletes one specific tag and nothing else.
Methodology labs
Realistic apps with many inputs where most are correctly encoded and only ONE input in ONE context is exploitable. Probe systematically, find the real sink, prove it.
- ⬜ find-the-contextmethodology
A realistic account panel with many inputs - only ONE is actually exploitable.
There are no flag{...} values here. Proof of execution is self-contained: any payload that runs should call /m03-p/api/solve/<slug>. Track your session on Progress.