PlanetSheet
Let's start by warming a little bit! I love planets and I hate sheets so I made this website to show my favorite planets. Flag is in admin cookie. Link: http://20.233.9.240:1337
In this challenge our input is reflected into an XSL document. For instance:
When rendered in the browser, this yields an error.
Since the Content-Type
is text/xsl
, we can use <x:script>
to perform XSS (source).
The final payload was
Last updated
Was this helpful?