Cross-site scripting – Reflected XSS | PortSwigger Lab Note #3

This PortSwigger lab demonstrates a reflected XSS vulnerability where common tags like <script> are blocked but SVG-related tags bypass the filter. By using Burp Intruder to systematically identify allowed tags and attributes, a working XSS payload can be constructed. The recommended remediation includes context-aware output encoding, input validation, and Content Security Policy implementation.