webPromedium
Lab 271 — TeamPulse — Stored XSS via HTML File Upload
hackadvisor
Task: collaborative project management app with file upload; HTML files served as text/html without sanitization, admin bot reviews uploads. Solution: upload HTML with JavaScript that reads admin's non-HttpOnly flag cookie and exfiltrates it via path-encoded Image beacons to Interaction Server.
$ ls tags/ techniques/
file_uploadnodejsxssstored_xssexpresshtml_injectionadmin_botcookie_theftheadless_chromedecoy_flagnon_httponly_cookieinteraction_server
admin_bot_exploitationdecoy_flag_eliminationnon_httponly_cookie_theftcookie_exfiltration_via_document_cookiestored_xss_via_html_file_uploadcontent_type_text_html_servingpath_based_data_exfiltrationinteraction_server_oob_callbacksame_origin_page_fetching
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]DevPulse — CSRF via JSON Content-Type Bypass— hackadvisor
- [web][Pro]Lab 70 — LivePulse— hackadvisor
- [web][Pro]Lab 69 — TeamPulse — Reflected XSS in OAuth2 Error Callback— hackadvisor
- [web][Pro]DesignPulse — Reflected XSS via SVG Badge Injection— hackadvisor
- [web][Pro]Lab 231 — PagePulse — XSS via Web Cache Poisoning— hackadvisor