# XSS (Reflected)
> #### Objective
>
> One way or another, steal the cookie of a logged in user.
##
## Security Level: Low
> Low level will not check the requested input, before including it to be used in the output text. Spoiler: ?name=alert("XSS");.
* Let's prove `john` as the input.
* We can see that our input is being reflected back to us.
* Let's provide the following input:
```
```
##
## Security Level: Medium
> The developer has tried to add a simple pattern matching to remove any references to "", to disable any JavaScript. Spoiler: Its cAse sENSiTiVE.
* Let's check out the source code.
* The `
```
##
## Security Level: High
> The developer now believes they can disable all JavaScript by removing the pattern "\
* The developer has used the `preg_replace` function.
* However, we can still use HTML events in order to trigger the alert.
* For our payload we can use the `` attribute as follows:
```
```
