Progress

0 / 12 XSS contexts fired this session. Each row is a different injection context - the goal is to notice how the payload has to change as the context changes. No flags: proof is calling /m03/api/solve/<key> from a payload that actually executed.

⬜ Reflected XSS - HTML body context (Search)

⬜ Reflected XSS - HTML attribute context (break out of value)

⬜ Reflected XSS - JavaScript string context (break out of quotes)

⬜ Reflected XSS - URL / href context (javascript: scheme)

⬜ Stored XSS - guestbook comment rendered to later viewers

⬜ Stored XSS - profile display-name / bio rendered elsewhere

⬜ DOM XSS - location.hash into innerHTML

⬜ DOM XSS - query param into document.write

⬜ Filter bypass - naive blacklist strips <script> only

⬜ Attribute injection - brackets encoded, event handler still fires

⬜ Mutation XSS - sanitize-then-innerHTML re-parse revives payload

⬜ Weak CSP - unsafe-inline lets injected inline script run