Lab 207 — FleetPulse — Reflected XSS via Base64 Bypass

hackadvisor

Task: Fleet management app with protobuf-like URL encoding for map state; base64 field type (!4z) bypasses HTML sanitization applied to string type (!4s). Solution: Encode XSS payload as base64 in !4z field, submit crafted URL to admin bot via /map/report, exfiltrate admin cookie via same-origin /api/feedback POST.