SECURITY LAB / 001
Find the sink.
Break the assumption.
Three small exercises for seeing how untrusted data crosses a browser context. Read the source, try the input, then open the answer.
Intentionally vulnerable. These pages are teaching examples. Run them locally or on your own lab hostname only. Do not copy the demo patterns into production code.
THE WORKBENCH
Choose a context
3 exercises / beginner → intermediate
HTML context
Reflected XSS
Trace a query parameter from the URL into an HTML sink.
start exercise →URL context
Anchor link
See why putting user input in an href needs a scheme check.
JavaScript context
JS string injection
Watch a value escape its string and become executable code.
start exercise →THE LOOP
Read
Look for the source and the sink before touching the payload.
Try
Change the URL input and observe what the browser does.
Fix
Open the answer and compare context-aware defenses.