/ Vulnerability tests
ISOLATED DEMO LAB

XSS · PROMPT INJECTION · AUTH

Put the defenses to the test.

Reproduce a weakness. Inspect the evidence. Verify the hardened fixture.

Real browser probes

Does untrusted input become executable code?

Run three fixed probes through reflected HTML, a quoted attribute, and a DOM sink. The browser reports whether the execution marker fired.

3built-in cases

Only the fixed probes run, inside sandboxed frames without access to Guardrail’s cookies or page. A timeout is inconclusive, never a pass.

XSS-01 · HTML response body

Reflected HTML

<script>guardrailHit()</script>
XSS-02 · Quoted HTML attribute

Attribute breakout

"><svg onload="guardrailHit()"></svg>
XSS-03 · innerHTML versus textContent

DOM HTML sink

<img src="data:image/png;base64,broken" onerror="guardrailHit()">
OWASP guidance ↗

Start with the vulnerable fixture.

Collect evidence, then run the same cases against the hardened fixture.

Before & after

Latest built-in cases per configuration

Run both configurations to compare their results. Custom documents are excluded because their inputs may differ.

These results describe the selected fixtures and inputs. They do not certify the security of Guardrail or another application.