webPromedium
Lab 75 — StayNest — Stored XSS in Hotel Booking Form
hackadvisor
Task: hotel booking platform where admin reviews bookings, HttpOnly cookie blocks external exfiltration. Solution: stored XSS in special_requests field exploits unescaped EJS in admin panel, uses internal unauthenticated API to exfiltrate flag.
$ ls tags/ techniques/
stored_xss_injectionhttponly_cookie_bypassinternal_api_exfiltrationadmin_panel_exploitation
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 33 — PulsePress — Reflected XSS in Search Page— hackadvisor
- [web][Pro]Lab 73 — NetShield — Reflected XSS via 404 Page Attribute Injection— hackadvisor
- [web][Pro]Museum— hackerlab
- [web][Pro]Lab 113 — CloudNest— hackadvisor
- [web][Pro]Lab 328 — DataNest — NoSQL Operator Injection in Authentication— hackadvisor