Beginner·150 points·26 solves
PixelSearch — Reflected XSS
Learn reflected cross-site scripting: when a site copies your input into its HTML without escaping, your input can become code the browser runs.
The search page drops your term straight into the response HTML:
<div>Showing results for: YOUR_INPUT</div>
Nothing escapes the < > and " characters, so if YOUR_INPUT is an HTML tag, the browser builds it as a real element. A <script> tag runs; an <img> with a broken src and an onerror handler runs too. The fix is to HTML-escape output (< becomes <) so input is always shown, never run.
Your tasks
1
Open the search page
Click Open lab and try a normal search. Your term is echoed back under "Showing results for:".
2
Watch where your input lands
View source (or just look): your text is placed directly inside the page HTML, not escaped.
3
Inject a tag
Instead of plain text, submit something that a browser reads as HTML — a tag with a script or an event handler.
4
Make it execute
A payload that a browser would run (not just display) trips the check and reveals the flag.
5
Capture the flag
When your script executes, the page shows the flag. Submit it in the panel.
Submit the flag
Start the lab, capture the flag from the running machine, and submit it here.