Redteam reflected xss

[wetpossum1]

Summary

This PR reintroduces a reflected XSS vulnerability for a red/blue team exercise.

Vulnerability

Route: /greet
Line: return f"<h1>Hello {name}</h1>"

An attacker can inject JavaScript via:
/greet?name=<script>alert(1)</script>

Why It Matters

• Raw user input is reflected without sanitization or escaping
• Allows XSS in browsers with no output filtering
• Would bypass basic review unless specifically checked

How It Should Be Caught

• Manual code review (watch for unsanitized template injection)
• CI tools (e.g., HTML escaping checks, Flask test cases)
• Fix: Use flask.escape(name) or a templating engine with auto-escaping