In this post, we are going to solve the PortSwigger lab: “Stored XSS into HTML context with nothing encoded”.
To solve the lab, we need to execute the alert function in a post comment.
When we open the lab, the first thing we need to do is navigate to any post:
Inside the post, we find the following:
As we can see, we have the option to leave a comment and different fields to fill out.
So we are simply going to do as instructed and fill out all the fields, but in the comment field, we will place a small piece of JavaScript code that executes an alert:
With all the fields filled out, we simply submit the comment and we will have solved the lab:
To see what happened, let’s go back to the post where we wrote our comment:
And as we can see, when entering the post, the code we had written in the comment field is executed. We have just exploited a Stored XSS.
