mission · xss-capstone-chain
Capstone: Session Hijack
The full chain. HackerMart's admin is logged in with a session cookie. 1) Plant a stored payload in the guestbook. 2) When the admin visits, it steals their cookie to your attacker panel. 3) Use the stolen cookie to hijack the admin's session — paste it into the hijack form. That's a complete XSS-based account takeover.
objective
Exfiltrate the admin's cookie AND use it to hijack their session.
Guestbook
Leave a comment about your shopping experience.
attacker.hp-lab.local — listening
Exfiltration log
No requests captured yet. Plant a payload that calls fetch()…
Simulated target for training. This page is the vulnerable website — payloads you craft execute here in your browser. Practice only on systems you own or are authorized to test.
No comments yet. Be the first!