Last updated
Was this helpful?
first we will put a random string in all fields and then post the comment then return to the post and inspect where the random string is located and based on where we will decide which payload may be successfull
once our comment is there open the developer tools and seach for xxxx
so we have to places the website field input is located in the href attribute and the other one (comment input field) is on the paragraph tag <p></p>
the comment input is not a good target since the application does some encoding to the input provided by the user
so we will be targeting the one in the href attribute
A way to inject the alert within the href attribute is to inject a JavaScript URL: javascript:alert(1) as website.
and we have solved the lab
