Defenses: No URL parameters are reflected. The page reflects the HTTP Referer header back to the user without HTML encoding.
We like to track where our visitors come from. Below is the URL that linked you to this page.
CONCEPT: HTTP Header Injection
Browsers send various HTTP headers with every request, such as User-Agent, Accept-Language, and Referer. Developers often assume these are generated by the browser and are therefore "safe". However, attackers can easily manipulate headers using proxies (like Burp Suite) or extensions. If an application logs these headers and displays them in an admin panel without encoding, or reflects them directly to the user (like in this challenge), it creates an XSS vulnerability.
You arrived here from:
Note: Standard browser navigation might URL-encode the Referer. To solve this lab, you usually need an intercepting proxy (like Burp Suite) to send raw, unencoded payload characters in the header.