Try touching something! Add ?touch=...
to the URL.
Ingredients:
Instructions:
Hint: This page is vulnerable to reflected XSS. Try injecting a script using the touch
parameter!
Example: level1.html?touch=<img src=x onerror=alert('XSS')>