Reflected XSS in a search field
The search term is reflected into the HTML response with no encoding. Craft a URL that pops an alert in the victim's browser.
Scenario
The results page echoes your query back into the HTML:
<h1>0 search results for 'PLACEHOLDER'</h1>
No output encoding is applied. The reflection is in plain HTML text.
Your objective
Deliver a working reflected XSS that calls alert() on the search page. The lab is solved when the exploit fires in the lab victim's browser.
Capture 1 flag(s) and record the exact technique for each step.
Getting started
- Search for a unique marker and confirm it appears verbatim in the page source.
- Break out of the text context:
<script>alert(1)</script>or<img src=x onerror=alert(1)>. - Build the full URL with the payload URL-encoded in the
qparameter. - Use the lab's "Deliver to victim" button (or load it yourself) to trigger it.
- Submit the payload string you used as the flag.
Connecting
Press Launch Lab to build your own instance, then use the How to connect panel — it shows the browser link as soon as the app is running. Hit Stop when you are done, or Relaunch / Reset for a clean copy.
Credentials: No account needed.
Hints
Tip
If <script> is stripped but other tags survive, an event handler like onerror on an <img> still runs.
How to connect
Connect to the lab VPN first
Lab machines sit on an isolated network with no public address. Connect to the VPN once — the same config works for every lab.
1 · Get your config
Download rooted-labs.ovpn2 · Connect
Linux / macOS — from a terminal:
Windows / mobile — import the file into OpenVPN Connect, Tunnelblick, or the OpenVPN GUI.
3 · Reach the machine
Once connected, the address shown below (SSH command / lab link / RDP command) is reachable. Only lab traffic is routed through the VPN — your normal internet is untouched.
Step 2 — reach the machine
Open the lab in your browser:
Open labCredentials: No account needed.
The app can take a few more seconds to finish booting after the link appears.
Starting the container — your link will appear here automatically.
Launch the lab (sidebar) to get your link.
SSH into the machine:
Password for rabbit:
Log in as rabbit (has sudo). First login may take a few seconds while SSH finishes starting.
Provisioning — the SSH command will appear here when the machine is ready.
Launch the lab (sidebar) to get the SSH command.
Challenge questions
0 / 2 correct- Submit the initial flag you recovered while solving this lab.
- Which vulnerability class does this lab cover? (a few words)
On this page
Access
FREEAt a glance
- Operating system
- Web application
- Connection
- Browser / HTTP
- Questions
- 0 / 2 solved
- Launched by
- 0 hackers
- Maintained by
- Sarina Gulgowski
Your machine
Status
Booting your machine — this takes about a minute. Connection details appear in the brief below when it's ready.
Ready — see How to connect below.
Provisioning failed. Hit Relaunch to try again.