Level 6: Follow the 🐇 As in Level 3, we have a URL fragment to work with. In this case it's the value after the fragment that is used to set the source of the script that will be called by the page. Again, by checking the source code we can see that the devs have implemented some basic validation.

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.

Definition. Cross-site scripting (XSS) is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. Attackers often initiate an XSS attack by sending a malicious link to a user and enticing the user to click it.