An offline, Dockerized web app for teaching reflected XSS → cookie theft → account takeover, with three difficulty levels (Low / Medium / High).
