Dashboard

Welcome to RatXSS - a single-topic lab for CWAP Module 03: Cross-Site Scripting. Twelve sinks, twelve different injection contexts. The skill being drilled is context-aware payload construction: the same string is dangerous in one place and harmless in the next.

Where the bugs live

Search - reflected contexts (body, attribute, JS string, href), a naive filter, a bracket-encoded attribute, and a weak-CSP page.
Comments - stored XSS rendered to later viewers.
Profile - stored display-name / bio rendered in another view.
Widgets - client-side DOM sinks (innerHTML, document.write, a sanitize-then-innerHTML mutation case).
Progress - how many of the 12 you have fired this session.

Proof-of-execution is self-contained: any payload that runs should call /m03/api/solve/<key>. There are no flag{...} values in this lab.