• Comments (vunerable to SQL Injection, XSS, CSRF)
  • Images (vunerable to exposure of files)
  • Evil site (for testing and with one XSS example)