← back to room
Stored XSS
Stored XSS Guestbook
Scenario
VisitorLog's guestbook saves comments and renders them for every later reader. HTML you submit persists in the database. Leave a note that executes JavaScript when anyone views the page.
Your approach
- Post a harmless comment to see how entries display.
- Submit a persistent HTML payload with an automatic event handler.
- Reload the guestbook and confirm your script runs on view.
- Copy the flag from the lab success banner.
- Submit the stored payload flag.
Comments are stored and rendered with no encoding. Leave a payload, then reload — when it persists and executes, the flag appears.
Post a comment
Guestbook
No comments yet.