Defenses: No user input is reflected from the URL. The client-side script reads the window.name property and inserts it into the DOM.
The page doesn't take any URL parameters. It relies on a special browser property to load personalized content.
CONCEPT: Cross-Origin Data Smuggling via window.name
The window.name property is unique: it does not reset when the browser navigates to a new domain in the same tab. An attacker can set window.name="payload" on their malicious site (attacker.com), and then use JavaScript to redirect that same tab to a vulnerable application (target.com). If the target app reads window.name and inserts it unsafely into the DOM (e.g., using innerHTML), the attacker achieves Cross-Site Scripting without needing to craft a suspicious URL with a payload.
Welcome back! Your saved profile name is:
Note: In a real attack, the victim would visit an attacker's page first. To solve this lab locally without setting up another site, just use your browser console: window.name="<script>alert(1)</script>"; location.reload();