webPromedium
DesignPulse — Reflected XSS via SVG Badge Injection
hackadvisor
Task: Express/Node.js design platform with SVG badge generator that reflects unsanitized query parameters into SVG text elements; admin bot reviews reported URLs. Solution: Injected script tag via SVG badge name parameter, exfiltrated admin's non-HttpOnly flag cookie to unauthenticated feedback API endpoint.
$ ls tags/ techniques/
nodejsxsscookie_stealingexpressadmin_botsvgreflected_xssdecoy_flagsame_origin_exfiltrationbadge_injection
admin_bot_exploitationhoneypot_flag_identificationsvg_script_injection_via_unsanitized_parameterreflected_xss_in_svg_badge_endpointsame_origin_exfiltration_via_unauthenticated_api
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]DevPulse — CSRF via JSON Content-Type Bypass— hackadvisor
- [web][Pro]Lab 56 — DataPulse — XXE to SSRF via SVG Avatar Upload— hackadvisor
- [web][Pro]Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection— hackadvisor
- [web][Pro]CloudPulse — OAuth CSRF Account Takeover via Missing State Parameter— hackadvisor
- [web][Pro]Lab 271 — TeamPulse — Stored XSS via HTML File Upload— hackadvisor