Devlog 1: started building a lightweight, vanilla JS retro web terminal from scratch (no frameworks, no AI).

But as I was fixing bugs and styling the prompt, I realized something. Why not use my own projects to teach others cybersecurity?

So, I turned my terminal into the first interactive lab for my upcoming project: CyberSecurityLearningLabs In the latest update, I intentionally swapped textContent with innerHTML inside my terminal history function. This opens up a textbook DOM-based XSS vulnerability.

If you type a malicious payload like an img tag with an onerror event directly into the terminal, the browser parses the HTML, fails to load the broken source, and triggers the JavaScript payload (like a classic alert pop-up).

I left a hint in the code comments explaining how to patch it using textContent, making it a perfect, hands-on demonstration of why sanitization matters