ISOLATED LIVE BROWSER SECURITY DEMOS
16 SEPARATE DEMOS · EACH ON ITS OWN PAGE
Overlay + hidden autofocus form triggers Chrome autofill dropdown and captures credentials on click.
Deceptive login UI that silently harvests autofilled username/password fields without user awareness.
Splits password across multiple hidden fields to bypass autofill heuristics and reassemble credentials.
UI redressing attack that positions fake elements over password manager autofill suggestions.
Transparent iframe overlay tricks users into clicking hidden buttons on an embedded victim page.
Tricks users into dragging sensitive text into an attacker-controlled drop zone for data theft.
Abuses Fullscreen API to render a fake browser chrome and credential harvesting page.
Mutates form action/method at runtime to redirect submitted credentials to attacker endpoint.
Unsafe innerHTML assignment from URL hash demonstrates client-side XSS without server involvement.
Query parameter echoed unsanitized into the DOM — simulates reflected XSS attack surface.
CSS attribute selectors leak input values character-by-character to background URLs.
Auto-submitting hidden form demonstrates cross-site request forgery without anti-CSRF tokens.
Simulates overly permissive Access-Control-Allow-Origin enabling cross-origin data theft.
window.opener manipulation replaces the original tab with a phishing page after link click.