Bug Chain Expert

Bug Chain: XSS → CSRF → ATO

One story. Three bugs. Take over the account email.

Mission briefing

NoteShare combines persistent notes with a passwordless email-change form. There is no CSRF token on account updates, and notes render raw HTML. Chain weaknesses together to redirect a victim's login email to an address you control.

0 / 1 tasks 0 / 25 pts

Objectives

Store XSS
CSRF email change
Claim ATO flag

Task 1 Full chain Expert 25 pts

Scenario

NoteShare lets users leave HTML notes and change account email via a bare POST. There is no CSRF token on email updates, and notes render unsanitised. End-to-end, redirect a victim's login email to an address you control.

Your approach

Explore note creation and the account email change form.
Either forge a cross-site POST to the email endpoint or store XSS that performs it.
Change the victim email to your attacker domain.
Confirm the lab registers a full chain takeover.
Submit the chain ATO flag.

Change email to an attacker domain via the chain.

Open lab →

Hint

XSS note that POSTs to /labs/chain/email — or just CSRF the form directly for the flag

Submit the chain ATO flag.