← back to room
Stored XSS
Blind XSS via Admin Bot
Scenario
Hotel staff use an automated bot to review reported guestbook URLs. The bot loads reported pages with a privileged session cookie. Trigger your stored payload when the bot visits a link you supply.
Your approach
- Plant executable HTML in the guestbook or a reflected parameter on the report URL.
- Use the report feature to send the bot to that page.
- Wait for the bot visit indicator on the lab page.
- Read the blind hit flag shown after the bot executes your script.
- Submit the blind XSS flag.
Report a URL to the admin bot. If the URL (or your stored guestbook XSS) executes JS in the bot, you get the blind XSS flag. Tip: plant XSS in the guestbook first, then report that lab URL.