C
← Web Security Academy

Cross-site scripting (XSS)

Lab

DOM XSS via document.write

Practitioner+120 XP

This lab uses document.write (simulated) with a URL parameter. The sink is entirely client-side.

Objective: Craft a URL fragment/query that causes script execution through the DOM sink.

How to solve this lab

  1. Click ACCESS THE LAB — the vulnerable app loads from lab.cyberlium.com inside this page (you stay on cyberlium.com).
  2. Follow the objective. Use the hint if you get stuck; open Solution guide only if needed.
  3. When you see a flag like CYBERLIUM{…}, copy it into Submit solution.
  4. Sign in first — correct flags add +120 XP to your account.

Practice app runs on the lab subdomain in the background — you never leave cyberlium.com. XP still goes to the same account.

Sign in first so XP is saved to your account.