Reflected XSS Lab - innerHTML Based

📚 What is Reflected XSS?

Reflected Cross-Site Scripting (XSS) occurs when user input is immediately returned by a web application without proper sanitization or encoding. The malicious script is "reflected" off the web server in the response.

In this lab, we use innerHTML to display user input directly, which allows HTML and JavaScript to be executed in the browser context.

🧪 Try It Yourself

Enter your name:

Output:

💡 Try These Payloads

Copy and paste these into the input field to see the vulnerability in action:

<img src=x onerror=alert('XSS')>

<script>alert('Reflected XSS!')</script>

<img src=x onerror="alert(document.cookie)">

🔍 Understanding the Vulnerability

Vulnerable Code:

                
// ❌ VULNERABLE: Using innerHTML with user input

const output = document.getElementById('output');

output.innerHTML = 'Welcome, ' + userInput + '!';

The problem: innerHTML parses the string as HTML, so any HTML tags or JavaScript in the user input will be executed.

Secure Code:

                
// ✅ SECURE: Using textContent instead

const output = document.getElementById('output');

output.textContent = 'Welcome, ' + userInput + '!';

// ✅ SECURE: Or create text node

const textNode = document.createTextNode(userInput);

output.appendChild(textNode);

// ✅ SECURE: Or use DOMPurify library

const clean = DOMPurify.sanitize(userInput);

output.innerHTML = 'Welcome, ' + clean + '!';

⚠️ Real-World Impact

Cookie Theft: Attackers can steal session cookies and hijack user accounts
Phishing: Display fake login forms to steal credentials
Malware Distribution: Redirect users to malicious websites
Data Theft: Access sensitive information on the page
Defacement: Modify page content to damage reputation

🔒 Prevention Techniques

Use textContent: Always use textContent instead of innerHTML for user input
Input Validation: Validate and sanitize all user inputs
Output Encoding: Encode special characters (e.g., <, >, &)
Content Security Policy (CSP): Implement CSP headers to prevent inline scripts
Use Libraries: Consider using DOMPurify or similar sanitization libraries
HttpOnly Cookies: Set HttpOnly flag on cookies to prevent JavaScript access

🔴 Reflected XSS Lab