⚠ DEMO 10 — Reflected XSS Simulation | Authorized research only

REFLECTED XSS SIMULATION

QUERY PARAM · UNSANITIZED ECHO

Simulates server echoing ?search= parameter into HTML without encoding. Attacker crafts malicious URL; victim clicks and script executes in their session.

[ SEARCH RESULTS ]

Sample payload:

<script>alert('XSS')</script>
[*] Enter search term or use URL ?search= parameter...
Fix: HTML-encode output (OWASP ESAPI), Content-Security-Policy, validate input server-side.