This lab contains a reflected XSS vulnerability with some whitelisted tags, but all events and anchor href attributes are blocked..
To solve the lab, perform a cross-site scripting attack that injects a vector that, when clicked, calls the alert function.
Note that you need to label your vector with the word "Click" in order to induce the simulated lab user to click your vector. For example: <a href="">Click me</a>
Visit the following URL, replacing your-lab-id with your lab ID: