Reflected XSS into HTML context with all tags blocked except custom ones

Platform: PortSwigger | Category: Cross Site Scripting | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Cross Site Scripting

Summary

Walkthrough of the PortSwigger Web Security Academy lab Reflected XSS into HTML context with all tags blocked except custom ones (Cross Site Scripting). This lab demonstrates a cross site scripting vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Cross Site Scripting

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

The search term is reflected in the page response embedded within <h1> tags.

 js read-only • copy allowed Copy
<h1>5 search results for 'Hi'</h1>

When we enter <script>in the search field, it gets blocked.

Use custom tags -

The search url is as follows -

https://0a96000b03ae5d4b80e03a7000a2002d.web-security-academy.net/?search=hello

We can use the following payload to pop an alert with document.cookie.

 html read-only • copy allowed Copy
<shebu onfocus=alert(document.cookie)  tabindex=1 id=1';

• shebu - custom tag.

• onfocus=alert(document.cookie) - whenever the particular tabindex is focussed, it will trigger a alert.

• tabindex=1 - when tab in pressed 1 time , it will get selected.

• id=1 - this will help us to specify which tabindex to use.

  Final payload -

Key Takeaways / Lessons

• Understanding Cross Site Scripting detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Reflected XSS into HTML context with all tags blocked except custom ones