cross-site scripting

XSS happens when an application takes attacker-controlled input and renders it as part of a page without proper output encoding, letting the attacker execute JavaScript in another user's browser session.

The labs in this category cover the three classic shapes (reflected, stored, DOM), context-specific exploitation (HTML body, attribute, JS, URL, CSS), filter bypasses, and impact: session hijacking, keylogging, CSRF chaining, and BeEF-style hooks.