← All labsxssreflected-xssstored-xsssession-hijackingadmin-bot View lab source →Solution walkthrough (spoilers) →
MediumXSS
NoteShare — from reflected XSS to admin takeover
A shared-notes app with a real support workflow: report a broken link and a support bot reviews it in a real browser, logged in as an admin. What you do with that is up to you.
Node.jsExpressEJSPuppeteer
Run it locally
git clone https://github.com/G3kSec/0xBugLabs.git
cd 0xBugLabs/labs/xss/noteshare-admin-bot
docker compose up -dThe app is at http://localhost:8081. Tear down with docker compose down.
Objectives (2)
- 01
Get real script execution via the search box
The search results page isn't as careful with your query as it should be. Prove you can run arbitrary JavaScript in your own session — not just get unescaped text in the response.
▸Hints (2) — stuck? optional, no spoilers
- 1.Your search term gets echoed back into the page. Try a value that would only matter if a browser parsed it as HTML.
- 2.Check whether the page escapes every field the same way, or just some of them.
- 02
Take over the admin account
The support bot visits reported links as an actual logged-in admin, in a real browser. Turn a note into something that steals what that session is worth, then use it.
▸Hints (2) — stuck? optional, no spoilers
- 1.The 'report' feature gets reviewed by someone with more privileges than you, in a real browser session.
- 2.What would a script need to do to get a session cookie out of that browser and somewhere you control?