A Flask site where logged-in users publish gossips, comment on them and search them, backed by MariaDB. User content is rendered into pages without escaping.
Not startedDockercommit 00fd734x86_64 · aarch64Secret
Inject JavaScript through a gossip, a comment or the search that runs in other users' browsers, and use it to steal their session cookie.
The brief for this lab lives in its repository.