Apprentice
← all rooms
Stored XSS Hard

Stored & Blind XSS

Plant persistent XSS and hit a simulated admin bot.

Mission briefing

VisitorLog runs a public guestbook on a boutique hotel site. Comments persist and render for every later visitor—including an automated moderator bot. Find out whether a note you leave can run code in another user's browser.

0 / 2 tasks 0 / 25 pts

Objectives

  • Store an XSS payload in the guestbook
  • Trigger blind XSS via the admin bot
Task 1 Stored XSS Medium 10 pts

Scenario

VisitorLog's guestbook saves comments and renders them for every later reader. HTML you submit persists in the database. Leave a note that executes JavaScript when anyone views the page.

Your approach

  1. Post a harmless comment to see how entries display.
  2. Submit a persistent HTML payload with an automatic event handler.
  3. Reload the guestbook and confirm your script runs on view.
  4. Copy the flag from the lab success banner.
  5. Submit the stored payload flag.

Guestbook stores and re-renders comments.

Open lab →
Hint

<img src=x onerror=alert(1)>

Task 2 Blind XSS Hard 15 pts

Scenario

Hotel staff use an automated bot to review reported guestbook URLs. The bot loads reported pages with a privileged session cookie. Trigger your stored payload when the bot visits a link you supply.

Your approach

  1. Plant executable HTML in the guestbook or a reflected parameter on the report URL.
  2. Use the report feature to send the bot to that page.
  3. Wait for the bot visit indicator on the lab page.
  4. Read the blind hit flag shown after the bot executes your script.
  5. Submit the blind XSS flag.

Report a URL to the admin bot.

Open lab →
Hint

Plant XSS in guestbook, then report that lab URL — or put JS in the URL field.