Weekend notes: learning to read HTML

posted by lab_author · Oct 17, 2026 · reading list

Same discussion thread as Lab 12 — but on this implementation the comment form only stores; rendering happens when readers open the comments. Add whatever you like below.

Method — storage and rendering are different requests
  1. Post </>test one, two, three. Inspect the response: your text is not echoed here — this page is only the plant.
  2. Visit wall.php — a plain URL with no parameters. That is the page real users hit; your comment is waiting there.
  3. Plant the payload (marker first), then load the wall in incognito. It fires with the URL clean — a stored bomb needs a visitor on the page, not a crafted link.
  4. Real-world mapping: the wall is where an admin or a regular visitor lands. The page delivers the payload for you.
Spoiler: the payload, and where it lives

Post either (comment body field):

<script>alert(1)</script>
<img src=x onerror=alert(1)>

Both detonate on the wall the moment it loads — for every visitor. Divide et impera: index.php is the plant; wall.php is the sink. When reporting stored XSS, screenshot the wall from a clean session to show it fires without any URL trickery. The wall keeps the last 8 comments.