DOM XSS and source-to-sink tracing
Lab 13 / 13 · Return to Arena
Welcome to this intentionally vulnerable training application.
Objective: DOM XSS and source-to-sink tracing. Inspect requests and responses with Burp Suite or browser developer tools. Use only the synthetic accounts and data supplied here.
Do not attack the arena portal or any system outside this lab.
Starting point: Trace URL fragment into the DOM
Try appending a value to the URL fragment, then watch how the page processes it.
Authorized training only · synthetic data · lab 13