XSS

Jul 17, 2026

30_Lab-Reflected XSS protected by CSP, with CSP bypass

Jul 12, 2026

29_Lab29-Reflected XSS protected by very strict CSP, with dangling markup attack

Jul 09, 2026

28_Lab28-Reflected XSS in a JavaScript URL with some characters blocked

Jul 08, 2026

24_Lab24-Exploiting XSS to bypass CSRF defenses

Jul 08, 2026

25_Lab25-Reflected XSS with AngularJS sandbox escape without strings

Jul 08, 2026

27_Lab27-Reflected XSS with event handlers and href attributes blocked

Jul 06, 2026

21_Lab21-Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped

Jul 06, 2026

22_Lab22-Exploiting cross-site scripting to steal cookies

Jul 05, 2026

16_Lab16-Reflected XSS with some SVG markup allowed

Jul 05, 2026

17_Lab17-Reflected XSS in canonical link tag

Jul 05, 2026

18_Lab18-Reflected XSS into a JavaScript string with single quote and backslash escaped

Jul 05, 2026

19_Lab19-Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped

Jul 05, 2026

20_Lab20-Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped

Jul 04, 2026

13_Lab13-Stored DOM XSS

Jul 04, 2026

14_Lab14-Reflected XSS into HTML context with most tags and attributes blocked

Jul 04, 2026

15_Lab15-Reflected XSS into HTML context with all tags blocked except custom ones

Jul 01, 2026

12_Lab12-Reflected DOM XSS

Jun 25, 2026

10_Lab10-DOM XSS in document.write sink using source location.search inside a select element

Jun 25, 2026

9_Lab9-Reflected XSS into a JavaScript string with angle brackets HTML encoded

Jun 24, 2026

8_Lab8-Stored XSS into anchor href attribute with double quotes HTML-encoded

Jun 20, 2026

5_Lab5-DOM XSS in jQuery anchor href attribute sink using location.search source

Jun 20, 2026

6_Lab6-DOM XSS in jQuery selector sink using a hashchange event

Jun 20, 2026

7_Lab7-Reflected XSS into attribute with angle brackets HTML-encoded

Jun 13, 2026

4_Lab4-DOM XSS in innerHTML sink using source location.search

Jun 12, 2026

1_Lab1-Reflected XSS into HTML context with nothing encoded

Jun 12, 2026

2_Lab2-Stored XSS into HTML context with nothing encoded

Jun 12, 2026

Hz Knowledge Base

[ vault ]

30_Lab-Reflected XSS protected by CSP, with CSP bypass

29_Lab29-Reflected XSS protected by very strict CSP, with dangling markup attack

28_Lab28-Reflected XSS in a JavaScript URL with some characters blocked

24_Lab24-Exploiting XSS to bypass CSRF defenses

25_Lab25-Reflected XSS with AngularJS sandbox escape without strings

27_Lab27-Reflected XSS with event handlers and href attributes blocked

21_Lab21-Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped

22_Lab22-Exploiting cross-site scripting to steal cookies

16_Lab16-Reflected XSS with some SVG markup allowed

17_Lab17-Reflected XSS in canonical link tag

18_Lab18-Reflected XSS into a JavaScript string with single quote and backslash escaped

19_Lab19-Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped

20_Lab20-Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped

13_Lab13-Stored DOM XSS

14_Lab14-Reflected XSS into HTML context with most tags and attributes blocked

15_Lab15-Reflected XSS into HTML context with all tags blocked except custom ones

12_Lab12-Reflected DOM XSS

10_Lab10-DOM XSS in document.write sink using source location.search inside a select element

9_Lab9-Reflected XSS into a JavaScript string with angle brackets HTML encoded

8_Lab8-Stored XSS into anchor href attribute with double quotes HTML-encoded

5_Lab5-DOM XSS in jQuery anchor href attribute sink using location.search source

6_Lab6-DOM XSS in jQuery selector sink using a hashchange event

7_Lab7-Reflected XSS into attribute with angle brackets HTML-encoded

4_Lab4-DOM XSS in innerHTML sink using source location.search

1_Lab1-Reflected XSS into HTML context with nothing encoded

2_Lab2-Stored XSS into HTML context with nothing encoded

3_Lab3-DOM XSS in document.write sink using source location.search