🚨 Vulnerable Form - No Input Validation

This form accepts ANY input without validation or sanitization

⚠️ Security Risk: This form has NO input validation!
Any malicious input will be processed and displayed without sanitization.

📝 User Registration Form (Vulnerable)

💀 Attack Demonstrations

Try these malicious inputs to see how the form processes them:

1. XSS Attack via Name Field

Payload:

<script>alert('XSS Attack via Name!')</script>

2. SQL Injection via Email

Payload:

' OR 1=1; DROP TABLE users; --

3. Command Injection via Website URL

Payload:

javascript:alert('Command Injection!'); void(0);

4. Path Traversal via Profile Picture

Payload:

../../../etc/passwd

5. HTML Injection via Bio

Payload:

<h1>Hacked!</h1><img src=x onerror=alert('HTML Injection')>

🔍 Vulnerability Analysis

What Makes This Form Vulnerable:

Attack Vectors Demonstrated:

🌍 Real-World Impact

These vulnerabilities can lead to:

🔴 Data Breaches

  • User data stolen
  • Database compromised
  • Personal information leaked

🟡 System Compromise

  • Server access gained
  • Files deleted/modified
  • System commands executed

🟢 User Experience

  • Website defacement
  • Malicious redirects
  • Phishing attacks

🔵 Legal Issues

  • GDPR violations
  • Data protection fines
  • Liability lawsuits

🛡️ How to Fix These Vulnerabilities

Check out our secure validation examples:

'; document.getElementById('email').value = 'test@example.com'; document.getElementById('phone').value = '123-456-7890'; document.getElementById('website').value = 'https://example.com'; document.getElementById('bio').value = 'Normal bio text'; document.getElementById('profilePic').value = 'https://via.placeholder.com/150'; document.getElementById('favoriteColor').value = 'blue'; console.log('🎯 XSS attack payload loaded'); } function testSQLInjection() { document.getElementById('fullName').value = 'John Doe'; document.getElementById('email').value = "' OR 1=1; DROP TABLE users; --"; document.getElementById('phone').value = '123-456-7890'; document.getElementById('website').value = 'https://example.com'; document.getElementById('bio').value = 'Normal bio text'; document.getElementById('profilePic').value = 'https://via.placeholder.com/150'; document.getElementById('favoriteColor').value = 'red'; console.log('🎯 SQL injection payload loaded'); } function testCommandInjection() { document.getElementById('fullName').value = 'John Doe'; document.getElementById('email').value = 'john@example.com'; document.getElementById('phone').value = '123-456-7890'; document.getElementById('website').value = 'javascript:alert("Command Injection!"); void(0);'; document.getElementById('bio').value = 'Normal bio text'; document.getElementById('profilePic').value = 'https://via.placeholder.com/150'; document.getElementById('favoriteColor').value = 'green'; console.log('🎯 Command injection payload loaded'); } function testPathTraversal() { document.getElementById('fullName').value = 'John Doe'; document.getElementById('email').value = 'john@example.com'; document.getElementById('phone').value = '123-456-7890'; document.getElementById('website').value = 'https://example.com'; document.getElementById('bio').value = 'Normal bio text'; document.getElementById('profilePic').value = '../../../etc/passwd'; document.getElementById('favoriteColor').value = 'yellow'; console.log('🎯 Path traversal payload loaded'); } function testHTMLInjection() { document.getElementById('fullName').value = 'John Doe'; document.getElementById('email').value = 'john@example.com'; document.getElementById('phone').value = '123-456-7890'; document.getElementById('website').value = 'https://example.com'; document.getElementById('bio').value = '

Hacked!

'; document.getElementById('profilePic').value = 'https://via.placeholder.com/150'; document.getElementById('favoriteColor').value = 'purple'; console.log('🎯 HTML injection payload loaded'); } // Initialize page console.log('🚨 Vulnerable form loaded - NO input validation!'); console.log('⚠️ This form accepts and displays any input without sanitization'); console.log('🎯 Try the attack demonstrations to see vulnerabilities in action');