webPromedium
Lab 70 — LivePulse
hackadvisor
Task: Express/Node.js support platform with WebSocket chat; chat.js renderMessage() uses innerHTML without sanitizing msg.content. Solution: Send stored XSS payload via WebSocket chat message, admin bot triggers it when visiting the ticket, exfiltrate non-HttpOnly flag cookie via same-origin notes API POST.
$ ls tags/ techniques/
nodejsxssstored_xsscookie_stealingexpressadmin_botwebsocketdecoy_flaginnerhtmlsame_origin_exfiltrationbulma
admin_bot_exploitationdecoy_flag_avoidancestored_xss_via_websocket_chatinnerhtml_xss_sinksame_origin_cookie_exfiltration_via_notes_api
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 48 — PulseDesk — Stored XSS via Widget postMessage DOM Injection— hackadvisor
- [web][Pro]Lab 226 — LiveDesk — SQL Injection via WebSocket Message Search— hackadvisor
- [web][Pro]Lab 271 — TeamPulse — Stored XSS via HTML File Upload— hackadvisor
- [web][Pro]Lab 66 — GrowthPilot — Stored XSS via User Registration— hackadvisor
- [web][Pro]DevPulse — CSRF via JSON Content-Type Bypass— hackadvisor