Reflected XSS — Search Bar

Field	Value
Platform	PortSwigger Web Security Academy
Vulnerability	Reflected Cross-Site Scripting (XSS)
Difficulty	Apprentice
Injection Point	Search bar (?search= query parameter)
Goal	Execute alert() in the browser via reflected XSS

---

Phase 1 — Reconnaissance

We land on a blog with a search bar.

---

Phase 2 — Confirming HTML Injection

Testing whether the search bar reflects HTML without sanitization:

<marquee>Kasane Teto</marquee>

The text scrolled across the page — the HTML tag was rendered by the browser rather than escaped and displayed as literal text. The application is inserting user input directly into the HTML response without encoding. HTML injection is confirmed, and script execution follows naturally.

---

Phase 3 — Reflected XSS Execution

<script>alert("Kasane Teto")</script>

The alert fired — reflected XSS confirmed. Lab solved. The URL now contains the payload:

/?search=<script>alert("Kasane+Teto")</script>

This URL itself is the attack vector — anyone who clicks it will trigger the script in their own browser context.

---