🧪 Labs › Cross-Site Scripting
Stored Cross-Site Scripting
Severity: High
Script you save in the app runs in every visitor's browser.
What it is
Cross-site scripting is the app handing your input to another user's browser as code instead of text. STORED XSS is the dangerous kind: your payload is saved (a comment, a profile field, a product review) and runs for everyone who later views it.
In the victim's browser your script runs with their session — it can read what they can read, act as them, and exfiltrate data.
The root cause is output that isn't encoded for the context it lands in (HTML body, attribute, JavaScript, URL).
How to approach it
- Find input that is stored and later shown to other users.
- Work out the exact context your input lands in when it's rendered — that decides what, if anything, breaks out of it.
- Confirm script execution with something harmless and obvious before reasoning about what it could do with a real victim's session.
- Consider which filters are in the way and whether the encoding is correct for the context or merely present.
Your task
Store a payload that executes in another user's browser when they view your content.
▶ Access the labOpens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.
How to prevent it
- Context-aware output encoding everywhere untrusted data is rendered.
- A strong Content-Security-Policy as defence in depth.
- Framework auto-escaping left on; treat any 'raw HTML' escape hatch as a red flag.