Progress

0 / 6 mini-labs solved this session. No flags: proof is calling /m03-p/api/solve/<slug> from a payload that actually executed (server-rendered sinks also auto-mark).

⬜ reflected-bodynaked
One search box; your input is echoed straight into the page body.

⬜ reflected-attrnaked
Your input is placed inside a double-quoted attribute value.

⬜ storednaked
A one-field guestbook renders saved entries to the next visitor.

⬜ dom-hashnaked
Client-side JS copies the URL #fragment into the page (innerHTML).

⬜ filter-bypassnaked
A naive filter deletes one specific tag and nothing else.

⬜ find-the-contextmethodology
A realistic account panel with many inputs - only ONE is actually exploitable.