History API Abuse – Security Lab PoC
Educational demonstration of pushState + popstate behavior
Made By Aryan Giri
Attack Simulation Controls
Inject 50 History Entries
Simulate Back Button Event
RESET STATE
History Entries Created:
0
popstate Events Triggered:
0
⚠ popstate detected — navigation behavior altered in simulation
Live Security Console
Educational Notes
history.pushState() modifies session history stack
popstate triggers on back/forward navigation
Used in SPAs, but can be abused for UX manipulation