Security Lab · Cross-Site Scripting

XSS Defense Lab

A focused, safe simulation of how user input becomes browser-executed code, and how mature platforms stop it. Nothing here executes for real — this walks through the path an attack takes, not the attack itself.

Ready
Stored XSS

A saved comment becomes code for the next viewer.

Run the vulnerable version first, then switch on Big Tech Mode to see the same payload blocked by layered defenses.

https://orbit.example/feed

Security evidence

No simulation run yet.

The inspector will explain whether the payload executed, was blocked, or had its impact reduced.

Events

Waiting for a run.

Cookie exposure

Session cookie state will appear here.

DOM path

Rendering context will appear here.

How the defenses stack up

Layers, not a single fix.

1. Encode and sanitize

Context-aware output escaping turns markup into inert text. HTML sanitizers strip scripts and dangerous attributes from anything that must stay rich text — the first and most direct line of defense.

2. Constrain the browser

Content Security Policy blocks inline and unauthorized scripts even if a payload slips through. Trusted Types stop unapproved values from ever reaching a sink like innerHTML.

3. Limit the blast radius

HttpOnly keeps session cookies out of reach of JavaScript entirely. SameSite reduces what a cross-site request can do with them. Neither stops the injection — both shrink what it's worth.

This lab is a simulation: payloads are analyzed and described, never executed. No script runs, no request leaves the page, and no data is collected.