Reflected XSS

Scenario

Greetly's homepage asks for your name and prints a friendly hello right below the form. Whatever you type appears in the HTML body as plain text—or so the developers assume. Your goal is to make the page run your code when a victim opens a crafted link.

Your approach

1. Open the greeting lab and submit a normal name to see how it reflects.
2. View page source and locate where your input lands in the DOM.
3. Try inserting HTML tags that execute JavaScript in that context.
4. Confirm the lab shows a success banner and copy the flag displayed on the page.
5. Submit that flag as your task answer.