# PixelSearch — Reflected XSS (lab)

> PixelSearch echoes your search term back into the page without escaping it. Craft an input that runs as JavaScript instead of being shown as text, and the flag is yours.

Canonical: https://codelivly.com/labs/reflected-xss

| | |
|---|---|
| Type | Web |
| Difficulty | Beginner |
| Points | 150 |
| Session length | 30 min |
| Completions | 26 |

PixelSearch echoes your search term back into the page without escaping it. Craft an input that runs as JavaScript instead of being shown as text, and the flag is yours.

## Objective

Learn reflected cross-site scripting: when a site copies your input into its HTML without escaping, your input can become code the browser runs.

## Tasks

1. Open the search page
2. Watch where your input lands
3. Inject a tag
4. Make it execute
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)