[Mission] Reflected Echo

🎯 Reflected Echo (Web · Level 2 · +120 XP)

A search bar echoes the query back directly into the response without contextual HTML escaping: `<div>Results for: <?= $_GET["q"] ?></div>`. Construct a payload that executes in the user session.

Learning & Defense Goals:

• Identify where user input is reflected in HTML
• Craft an innocent script payload like <script>alert(1)</script>
• Retrieve the verified payload flag

🎯 Launch Isolated Sandbox on Cyber Lab →

Community Discussion Rules: Discuss methodologies, discovery tactics, and architectural hardening. Please do not post raw flags directly. Share your production remediation code!