How to use the XSS Learning Lab
- 1. Pick a contextA comment box, a search value, a JavaScript variable or a profile link.
- 2. Type an inputSee the HTML the server would send, with your text inside it.
- 3. Test, then fixFind out what would run, then tick the escaping option to see the safe version.
Why context matters
Cross-site scripting happens when user input lands in a page in a place where the browser treats it as code. The fix depends on the context. Between tags, < must become <. Inside an attribute, the quote that closes it must be escaped too. Inside a JavaScript string, quotes, backslashes and </script> are dangerous. In a link, a javascript: URL runs code even when every character is escaped, so only safe schemes should be allowed. Use these skills only in labs like this one, or on systems you own or have written permission to test; attacking real websites is a crime under India's IT Act.
Nothing you type is ever executed here. The lab builds the page as text, parses it the way a browser would, and lists the script tags, event handlers and javascript: links your input created. We tested it with 29 classic payloads (all detected) and 17 harmless inputs (none flagged).
Worked example
In level 1, the comment <img src=x onerror=alert(1)> is inserted as-is, so the browser would create an image whose onerror handler runs alert(1) when the broken image fails to load. The lab reports one way your input would run code. Tick the escaping option and the server would send <img src=x onerror=alert(1)> instead, which the browser shows as plain text.
Defence in depth
- Use a framework that escapes by default (React, Angular, Django and Jinja templates) and avoid raw HTML APIs such as innerHTML.
- Add a Content-Security-Policy header that blocks inline scripts.
- Mark session cookies HttpOnly so scripts can't read them.
Frequently asked questions
What's the difference between stored and reflected XSS?
Stored XSS is saved (like a comment) and hits everyone who views it; reflected XSS comes from the current request (like a search term) and needs a crafted link.
Will the alert actually pop up?
No. The lab never runs your input; it tells you what a vulnerable page would run.
Is the XSS lab free?
Yes. You can open the XSS lab and try everything without signing up. When you test an input for the first time, we ask once for your name and WhatsApp number; after that it, and every other Uncodemy tool, opens straight away.