Stage 8 beginner
Cross-site Scripting (XSS)
See what happens when a customer review becomes code in a visitor's browser, then keep it as text.
Runs in your browser. Nothing to install — the lesson and a real Linux computer open side by side.
Start Stage 8 → Get Chapter 2 · $24 →One payment unlocks all four stages: Logins and Sessions, IDOR, SQL injection and XSS. Yours to keep, no subscription.
Already bought it? Sign in
Lesson steps
- Open the shop in a browser
- HTML gives text a shape
- Where does your search go?
- Make the search run a script
- A review stays on the page
- A different visitor sees the review
- HttpOnly hides a cookie from scripts
- A script can send requests as the visitor
- Escape output for HTML
- Add a second layer
- Final challenge: sign off the fix
- Stage complete
What this stage is
The shop now has a search page and customer reviews. Use the lab's Browser tab to see the pages, and curl to read the text the server sends. You'll learn how HTML shapes a page and how JavaScript makes things happen inside it.
The weak shop treats customer text as part of the page's code. This mistake is called cross-site scripting, or XSS. You'll start with harmless changes to the page, then see what happens when another visitor opens a saved review.
Why it matters
Code in a page can read what that visitor sees and send requests using their login. A cookie setting can hide the cookie's value from scripts, but it can't stop all those actions. The page needs to handle customer text safely in the first place.
You'll compare the weak shop with a fixed copy that displays input as text. You'll also test a browser rule that blocks scripts as an extra layer of protection.
By the end you'll be able to
- compare a page's HTML source with what a browser displays
- tell input returned by a search from input saved for later visitors
- explain why a script can act through a signed-in visitor's page
- check that customer text stays text, even when it contains HTML characters
- test both the browser's script rules and ordinary searches on the fixed shop
Ten flag challenges take you from reading a page's HTML source to testing the fix. You'll find flags hidden in the shop's pages, read one back through a reflected script, and read a note meant only for the moderator. The final challenge signs off the fix: the fixed shop's checklist releases a flag only when reflected and stored scripts stay text, ordinary punctuation stays readable, and the script policy is in place.