Vulnerable Web App
A tiny deliberately-broken app for practicing XSS and login-bypass. Runs entirely in-browser; no server to attack, nothing to install.
A deliberately broken application, small enough to understand completely. It has a reflected XSS and a login you can walk past, which are the two bugs almost every web security course opens with — and for good reason, since both are still found constantly.
How to use it
- Find the input that reflects into the page unescaped.
- Prove code execution rather than just displaying text.
- Walk past the login and note what the check was actually testing.
What to take away
XSS is about context
The same payload behaves differently inside an HTML body, an attribute, or a script block. Escaping has to match where the data lands.
An alert box is a proof, not an impact
What makes XSS serious is what follows — stealing session tokens, performing actions as the victim, rewriting the page to phish them.
Frequently asked questions
Is it legal to practise hacking here?
Yes. This is a simulation running in your own browser with no server behind it. That is the whole point — practise the technique somewhere you unambiguously own.
How is XSS actually fixed?
Context-aware output encoding, plus a Content Security Policy as a second layer. Blocklisting "bad" strings does not work; the space of encodings defeats it.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- SQL Injection Sandbox — A fake login backed by a simulated database. Watch your input become SQL, then bypass the login with a classic injection.
- CSRF Playground — A "bank" transfer endpoint trusts your cookie alone. Watch a malicious page forge a request on your behalf, then see a CSRF token stop it cold.
- Clickjacking Simulator — An invisible iframe sits on top of a fake game button. See exactly how a real click lands on a hidden "delete account" button instead.
- Security Header Analyzer — Paste HTTP response headers and get a graded report on the security headers present and missing.