// attack surface scanner

browser vulnerabilities

Live demonstrations of how a malicious website can compromise your browser — keyloggers, XSS, clickjacking, social engineering, and more. Everything on this page runs in your browser only. Nothing is transmitted anywhere.

click to expand / collapse ▼
– scanning
overall attack surface score
⏳running checks…
click to expand / collapse ▼

The moment your browser loads a page, any JavaScript on it can silently intercept everything you type, every key you press, and everything in your clipboard — without any special permissions. The demos below are happening right now on this page.

Keylogger  live 0 keys captured
press any key anywhere on this page…
↑ a real keylogger would send each keystroke to a remote server the instant you press it
Clipboard Sniffer  live
copy something, then paste anywhere on this page…
↑ passwords copied from a password manager are visible to any JS on the page you paste into
Accessible Cookies (no HttpOnly flag = JS can read them)
namevaluerisk
Why this matters: Every site you visit can log every keystroke, intercept passwords copied from your clipboard, and read any cookies not protected by the HttpOnly flag — silently, with no browser warning.
click to expand / collapse ▼

XSS happens when a website renders user-supplied HTML without escaping it. A vulnerable site's comments section, search bar, or profile field becomes a code execution point. Type some HTML below and see the difference.

try a payload (pre-loaded examples below):
✅ safe — textContent (escaped)
⚠️ unsafe — innerHTML (executes)
Why this matters: A vulnerable site lets an attacker inject <script> tags or event handlers that steal session cookies, redirect to phishing pages, or mine cryptocurrency — all running as if they were part of the legitimate page.
click to expand / collapse ▼

Scareware uses fear to make you act without thinking — fake virus alerts, fake law enforcement warnings, fake "your account is suspended" screens. Any website can display a full-screen overlay that looks completely convincing. The button below shows what this looks like. It will auto-dismiss after 6 seconds.

Fake credential harvester (form hijacking)

On a compromised or malicious site, any login form can silently forward your credentials to the attacker's server before the form even submits. The inputs below show what a site could capture:

email / username
password
↑ on a real phishing site this would be sent to the attacker with each keystroke
Why this matters: Social engineering accounts for over 80% of successful cyber attacks. The attack requires zero technical knowledge from the attacker — just a convincing visual and a moment of panic from the victim.
click to expand / collapse ▼

Clickjacking embeds a target site in a transparent iframe and overlays fake buttons on top. You think you're clicking "Play Video" but you're actually clicking "Transfer Funds" on your bank's site underneath. Hover over the button below to see the hidden overlay:

▶  Play Video
hidden: "confirm transfer"
⚠️ You "clicked" the hidden button underneath — not the green one you saw. On a banking site this could be "Confirm £5,000 transfer".
Protection check: This page protected against being embedded in an iframe by another site. See our security headers for details.
Why this matters: Without X-Frame-Options: DENY or Content-Security-Policy: frame-ancestors 'none', any site on the internet can silently embed your bank, your email, or your social accounts in a hidden iframe.
click to expand / collapse ▼
running checks…
click to expand / collapse ▼
🧱 uBlock Origin Blocks malicious script domains, ad trackers, and known XSS vectors before they load. Stops most drive-by keyloggers.
🔑 Password Manager A proper password manager (Bitwarden, 1Password) won't autofill on fake phishing domains, acting as a built-in phishing detector.
🌐 Check the URL Before entering any credentials, check the full URL carefully. Phishing sites use lookalike domains — g00gle.com, paypa1.com, bank-secure.xyz.
🔐 Enable 2FA Everywhere Even if credentials are harvested, hardware keys (YubiKey) or TOTP codes prevent account takeover in most scenarios.
🍪 HttpOnly Cookies If you run a website: flag session cookies as HttpOnly so JavaScript cannot read them even if XSS occurs.
📋 Be Clipboard-Aware Avoid copying passwords in a browser tab. Use your password manager's auto-fill instead — it doesn't touch the clipboard.
🚨 Treat Popups with Suspicion Legitimate software never needs you to call a phone number or download a "cleaner." If a page is screaming at you, close the tab.
🔒 CSP & Frame Guards For developers: implement a strict Content-Security-Policy and X-Frame-Options: DENY header on every page you own.