Echo

Echo is a small internal notes-and-search tool, and it is the gentlest cross-site scripting target on the platform — the on-ramp before Nightglass and The XSS Rat ask you to work blind. Two input paths reach the page without being encoded: one the server echoes back, one the browser assembles itself. An administrator reviews any URL you report to them, logged in as themselves. Getting your own browser to run script is step one; the finding that pays is the same script running in somebody else's session.