Stored XSS — Comment Board

Scenario

A blog has a comment box. The site stores comments in browser localStorage (the lab equivalent of a server DB) and renders each comment via innerHTML. There is no sanitization.

The page also has window.__FLAG set but never displays it. Your job: post a comment whose payload reads window.__FLAG and displays it.

Objective

Get the flag value (TC{stored_xss_…}) onto the screen — either via alert(), by writing it into a DOM node, or by reading it from devtools after your payload runs.

Why this is "stored" vs "reflected"

• Reflected: payload comes back from a query string just once (?q=…).
• Stored: payload persists in the backend (DB / localStorage / file) and fires for every viewer, including future ones.

A real stored XSS in a corporate Confluence or Jira can compromise every employee who loads the affected page.

Tips

• <script> tags inserted via innerHTML will NOT execute.
• Event handlers on freshly-parsed elements WILL execute.
• Try the classic <img src=x onerror="..."> vector.