Lab · Easy-Intermediate · 20 min Solved
Stored XSS
Leave a comment that runs later when anyone views the list. Still only in this browser sandbox.
1) The idea
The site saves your comment and shows it later as HTML. One bad comment can affect every viewer of that page.
2) Try it
Post a comment whose body runs window.__pwned() when the list redraws.
Hint 1
Same idea as reflected — but it is saved in the fake comment list.
Hint 2
Body: <img src=x onerror=window.__pwned()>
3) The fix
Store plain text; escape on output. Prefer a safe Markdown subset. CSP without unsafe-inline. Review admin tools that render HTML.
Simulated tools. They can only act on this lab's fake target inside the sandbox — there is no target field, no network, and nothing leaves your browser.
Stored XSS testerPosts probe comments to the fake guestbook and watches for execution on render.
$ xss-sim --stored
Recon (headers & forms)Lists the fake target's simulated headers and input fields.
$ recon-sim
Real scanners against real sites without permission are illegal. Use these ideas only on systems you own or are authorized to test.