Weekend notes: learning to read HTML

posted by lab_author · Oct 17, 2026 · reading list

Spent the weekend following the course lessons. The biggest surprise so far: most of the "hacking" steps are really about reading how your input gets printed back — status codes, reflection points, contexts. Drop a comment below with what part you'd start with.

Comments

1
KkaisecOct 17, 04:40:27just kaisec
Method — two stored fields, two sinks
  1. Marker first, as always: post the name </>test one, two, three with a plain comment. It lands on the listing — every stored field is a potential sink.
  2. But watch closely: the same payload as the name renders as text — that author column is escaped by this implementation. The sink doesn't travel with the data; it depends on where it's printed.
  3. Rendering check: post <u>test one, two, three</u> as the comment body. Underline appears → that field prints raw HTML straight out of storage.
  4. The stored twist: your URL is empty. Open this page in incognito (fresh session, no crafted link, no parameters) — it renders anyway.
  5. Payload: script or image tag in the body — it fires on load for every visitor.
Spoiler: three payloads, escalating

Confirm rendering, then detonate (all in the comment body field):

<u>test one, two, three</u>
<script>alert(1)</script>
<img src=x onerror=alert(1)>

Script and img both fire on page load — inline scripts execute while parsing and a broken img source triggers onerror. Prove "stored" in DevTools → Network: no query parameter, yet the payload arrives in the page. The list keeps the last 8 comments — a chatty page can evict old payloads.