Reflected XSS into HTML context with nothing encoded

🎯 Objective

Validate a reflected XSS where user input is reflected into an HTML context with no encoding; exploit by executing a simple alert().

🧭 Scope / Setup

• Tooling: Browser (address/search bar), optional Burp for recording
• Target: Search field that echoes input into HTML
• Precondition: Lab environment (authorized)

🔎 Approach

1. Paste the payload directly into the search bar and submit.
2. Observe the page for alert() execution or inspect response source.

🧪 Test Payload (used)

• <script>alert("hello ")</script>

✅ Outcome

• If the alert runs, the reflected XSS is confirmed.
• If payload appears unescaped in the HTML but doesn't execute, note context and retry with context-appropriate vectors.

🛡️ Mitigations

• Proper output encoding for HTML context.
• Use secure templating that auto-escapes.
• CSP script-src as defense-in-depth.
• Don’t rely solely on WAFs.

📝 Notes

• Lab has no CSP/CORS and backend does not escape input — direct script tags should execute.
• Repeat tests in multiple browsers if needed; keep trials minimal and controlled.
• Always test only in authorized labs.