The search box
The target's search page at /app/search takes a q parameter and shows it back to you. Try a normal word:
curl -s 'http://127.0.0.1:8080/app/search?q=hello'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/search?q=hello' <!doctype html><title>Search</title><h1>Search</h1><form action='/app/search'><input name='q' value='hello'><button>Go</button></form><p>Results for: hello</p><p>No results found.</p>
Notice hello appears twice in the HTML — once in the input's value and once in "Results for: hello". Your input is being written directly into the page. The question a pentester asks next is: is it escaped?