A Flask site where logged-in users publish gossips, comment on them and search them, backed by MariaDB. User content is rendered into pages without escaping.
Pas commencéDockercommit 00fd734x86_64 · aarch64Secret
Inject JavaScript through a gossip, a comment or the search that runs in other users' browsers, and use it to steal their session cookie.
Le brief de ce lab se trouve dans son dépôt.