NoteShare — Notes

Scenario

NoteShare lets users leave HTML notes and change account email via a bare POST. There is no CSRF token on email updates, and notes render unsanitised. End-to-end, redirect a victim's login email to an address you control.

Your approach

1. Explore note creation and the account email change form.
2. Either forge a cross-site POST to the email endpoint or store XSS that performs it.
3. Change the victim email to your attacker domain.
4. Confirm the lab registers a full chain takeover.
5. Submit the chain ATO flag.