XSS game
Inject scripts into vulnerable web apps, level by level
In the XSS game you attack small web apps that look like real ones. On each level you find where the app handles input unsafely and inject a script that runs. Hints and the source code are there if you get stuck.
Free · No login · Browser · Beginner
About XSS game
It trains you to spot the coding patterns that lead to cross-site scripting, so you can avoid them in your own code. Google made it mainly for web developers who are not security specialists. Experienced players will find the first levels easy.
It runs in the browser and needs JavaScript and cookies. There is no account. You could cheat with developer tools, but that defeats the point.
On Breakpoint since 23 Oct 2026.