This lab contains a reflected XSS vulnerability with some whitelisted tags, but all events and anchor
href attributes are blocked..
To solve the lab, perform a cross-site scripting attack that injects a vector that, when clicked, calls the
Note that you need to label your vector with the word "Click" in order to induce the simulated lab user to click your vector. For example:
<a href="">Click me</a>
Visit the following URL, replacing
your-lab-id with your lab ID: