Forum Discussion
Silver IIIHuman Connection Challenge: Season 1 – Web Exploitation - XSS
For the XSS, I would recommend you to test all of the available fields, one of them is the one and you should see the token in the same page, if it redirects to the main page, then that was not the correct field. Tip, try your script in all the fields at the same time!
Directory Traversal, you need to find a url with something like /test?field=something.txt, this could be an indicate of path traversal.
For SQL, only extract data is possible no modifications are allowed.
Silver IIhmm.. welcome down to the rabbit hole of IL labs :)
sometimes don't think too far, because the labs not always mimic reality. in reality yes, the XSS would be probably stored in a db, so the target would execute it.
but here: there are some "magic" fields which will magically convert the input to some web output, just find the right field or just use all fields :)
for the traversal... the include is quite straightforward. just abuse it, /etc/passwd is also accessible.
hope this will help you, to finish the lab.
