Lab 2

Stored XSS into HTML context with nothing encoded

We are given a normal looking website, but there is a XSS vuln in the comment feature. Let's test with a simple alert

Looking at one of the posts available there is the comment functionality

Let's test it with a simple alert

<script>alert('pwned')</script>

Post the comment

And we solved the lab