IAST Runtime Playground
This page wires common DOM sinks to attacker-controlled sources so the PTK IAST agent can observe taint flowing
through innerHTML, insertAdjacentHTML, inline event handlers, and navigation APIs.
Load it inside the monitored tab, trigger the flows below, and watch the background scan aggregate findings.
Quick start
- Launch a PTK IAST background scan against this page.
- Pass a payload via
?msg=<payload>,#hashPayload, or the controls below. - Observe the DOM updates and confirm findings show up under the IAST report.
The agent automatically taints URL/query/hash/cookies/storage/window.name, so you only need to provide the payloads.
Auto-reflected sources
Populate ?msg=, #hash=, document.cookie name
iast_payload, localStorage['iast_payload'], or sessionStorage. Each
source is rendered unsafely to trigger innerHTML/insertAdjacentHTML sinks.
Manual payloads
Enter any HTML/JS payload and push it through various sinks. Actions below will also stash the payload inside cookies and storage to exercise the agent’s source tracking.
Sink output
Current handler is injected directly through
setAttribute('onclick', payload).