It won't run because it could be malicious. M = s.getElementsByTagName(o) a.async = 1 a.src = g m.parentNode.insertBefore(a, m) I = r i = i || function (), i.l = 1 * new Date() a = s.createElement(o),

Now in this particular case you'll note that this pattern gets rejected by the website because there's some very rudimentary filtering (the ' That's pretty much XSS 101 - just get an alert box to fire - and reflecting a script tag is one of the most fundamental techniques attackers use to run their script on your website. The first thing that everybody tries is something similar to this: (0) The objective of this particular exercise is for the participants to steal the victim's auth cookie by constructing an XSS attack within the query string parameter. Then you can see it reflected in the page itself both in the search box and in the heading. You can see the search term - the untrusted data - in the URL: For example, if we take the sample vulnerable site I use in the exercises and search for 'foobar', we see the following: In that module, we cover reflected XSS which relies on the premise of untrusted data in the request being reflected back in the response.

The first one that starts to push people into territory that's usually unfamiliar to builders is the module on XSS. As it turns out, breaking websites is a heap of fun (with the obvious caveats) and people really get into the exercises. I run a workshop titled Hack Yourself First in which people usually responsible for building web apps get to try their hand at breaking them.

Hashbrown huntdown