Ultimate XSS Lab

HTTP Request
LIVE TRAFFIC 

        

    


    


        
        


            
            

                

                    

                    Interactive Security Sandbox
                

                

                    Web & XSS Security Lab
                

                
Start with core web building blocks, then simulate XSS attack vectors step by step.

            


            
            

                

                    
                    
                    

                        HTML CSS JS Core Concepts
                        

                             Expand Diagram
                        

                    


                    
                    

                        

                            FOUNDATION
                            
How Web Apps Work

                        

                        
                        
Web applications rely on three core pillars. XSS vulnerabilities occur when untrusted user input leaks into HTML structure or JavaScript execution context.


                        

                            

                                HTML
                                Structure
                            

                            

                                CSS
                                Styling
                            

                            

                                JS
                                Logic / Brain
                            

                        


                        

                            
                        

                    

                

            


            
            

                

                    

                         Select XSS Lab Module
                    

                    3 Interactive Labs
                


                


                    
                    

                        

                            

                                
                            

                            EASY
                        

                        
Reflected XSS

                        
Server reflects input directly in the HTTP response without saving it. Delivered via links.

                        

                            GET Request
                            URL Query
                        


                        
                        

                            

                                
                            

                            
Reflected XSS

                            
                        

                    


                    
                    

                        

                            

                                
                            

                            MEDIUM
                        

                        
Stored XSS

                        
Script saves to the database and executes automatically whenever anyone views the page.

                        

                            POST Request
                            Database
                        


                        

                            

                                
                            

                            
Stored XSS

                            
                        

                    


                    
                    

                        

                            

                                
                            

                            HARD
                        

                        
DOM-based XSS

                        
Vulnerability runs in browser JavaScript when processing unsafe DOM targets.

                        

                            Client-Side
                            URL Hash
                        


                        

                            

                                
                            

                            
DOM XSS

                            
                        

                    


                

            


            
            

                
EASY Reflected

                
MEDIUM Stored

                
HARD DOM-based