Code-flow microscope

Follow the
untrusted line.

Turn code into a physical data flow. Follow a source, find the sink, break the exploit.

Interactive path view

The scenario and controls work without 3D.
Interactive simulation
YOUR NEXT MOVE

Change the conditions. Change the outcome.

The experiment

Break it.
Then make it hold.

An untrusted search string flows through an HTML template into the browser. Find where this reflected XSS path should be fixed.

How this simulation works

Each run follows one deterministic path. An enabled control stops this particular scenario at its boundary. Results are educational, not a security assessment or a guarantee against other attacks.

Set the defences

0 of 3 enabled

Reject markup for this search endpoint; validation is not a universal XSS defence.

Apply context-appropriate encoding before inserting text into HTML.

Use a safe text sink so markup is displayed, not executed.

Ready when you are
BRIEFING

Run once without controls. Then activate a defence and compare what happens.

From an experiment to your environment.

Let’s find your
real attack paths.

Talk to Arica

Keep exploring

Return to the service universe