Create a vulnerable web application that is susceptible to a XSS attack. XSS attacks are very common out there so I am sure you can find plenty of discussion about it with a Google search. Create a web application (it does not have to be anything fancy or complicated, just enough to demonstrate the XSS vulnerability and it has to be your own code). If you dont already have some sort of web server available, you will need to stand one up, perhaps in a Virtual Machine. Most browsers and servers will provide XSS protection natively so you may need to disable that before your attack succeeds. You can choose the server-side language as long as the page renders in a typical browser.

Provide a screenshot proof of your XSS vulnerability being exploited by you including the script you inject and the resulting effect on the web application. In your write-up, discuss your vulnerability briefly and make a recommendation of how you would fix/prevent this attack from succeeding.