Account Registration — Training Demo

simulated attacker capture What an attacker could steal

Payload captured from this browser only. Nothing is transmitted anywhere.

{}

Missing HttpOnly: document.cookie exposes session cookies to any JavaScript on the page. Setting HttpOnly makes this field empty.
Client-side storage: localStorage and sessionStorage often hold JWTs or session identifiers in SPAs. Never store session tokens there.
No CSP: Without a Content-Security-Policy, an attacker can inject arbitrary JavaScript via XSS and run exfiltration scripts like this one.
Defense: Use HttpOnly, Secure, SameSite cookies, avoid storing tokens in web storage, and enforce a strong CSP.

For authorized security training only. This page runs entirely in your browser and sends no data to any external server.