Test your XSS payloads against intentionally vulnerable pages. Everything runs in a sandboxed iframe — no network access, fully isolated.
Input reflected directly into HTML body, no filtering.
Solved: 0/7
Payload Mutator Engine
Auto-generate 50+ WAF bypass mutations from any payload.
WAF Bypass Transformer
Transform payloads to evade Web Application Firewalls.
Encoding Pipeline
286 operations in a CyberChef-style chaining interface.
What Is This?
Auto-identify unknown data blobs with confidence scores.
Companion generator
XSS Payload Generator