Reflected XSS into HTML context with nothing encoded
Reflected XSS into HTML context with nothing encoded
Platform: PortSwigger | Category: Cross Site Scripting | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Cross Site Scripting
Summary
Walkthrough of the PortSwigger Web Security Academy lab Reflected XSS into HTML context with nothing encoded (Cross Site Scripting). This lab demonstrates a cross site scripting vulnerability and its exploitation to achieve the lab objectives.
Lab Overview
PortSwigger Web Security Academy — Cross Site Scripting
This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.
Lab Description :
Solution :
We straightaway see a search functionality.
The application echoes the supplied search term in the response to this URL:
https://0a650005031fe4c282a94ddd00e50078.web-security-academy.net/?search=hello
Click View Selection Source, shows how our data is being embedded in the page.
html read-only • copy allowed<h1>0 search results for 'hello'</h1>
Payload
Enter the following simple XSS payload to trigger an alert!
js read-only • copy allowed<script>alert(1)</script>
We have thus solved the lab.
Key Takeaways / Lessons
- Understanding Cross Site Scripting detection and exploitation is crucial for web security.
- Always validate and sanitize user input; implement proper access controls.
- This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.
Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Reflected XSS into HTML context with nothing encoded