XSS LAB

A hands-on lab demonstrating the difference between innerHTML (vulnerable) and textContent (safe) when rendering user input, built to visualize XSS attack surface in a browser environment.

• 15 working payloads: onerror, ontoggle, onmouseover, autofocus, javascript: href, etc.
• 14 blocked payloads: svg onload, script tag, iframe/object javascript:, etc. — blocked by default in HTML5 and modern browsers (Chrome/Edge).
• Includes a custom payload field to write and test your own payloads.

How to run

No installation needed. Clone the repository with git clone https://github.com/ebs1848/XSS-LAB.git (or download it) and open index.html in a browser.

Key takeaway

• innerHTML parses user input as HTML, so injected markup and event handlers can execute.
• textContent treats input as plain text, so the same payloads are displayed instead of executed.

Disclaimer

For educational purposes only. Run it locally and test only on systems you own or are authorized to test.