Webverselabs Challenge Sandpiper Stationery XSS

Scenario :

Sandpiper Stationery is a three-person wedding-invitation studio on the Cape, founded 2012 — letterpress suites from $640, six-to-eight week lead times, an Etsy following that finally outgrew the Etsy template. Their first standalone site went up in March. The tracking page was a last-minute add the freelancer described as “five lines, can’t go wrong” the afternoon before launch.

Solution :

This one was pretty straigh forward , not too many endpoints, just the Preview Button :

If we hit send :

It is reflected back to us , the emil field is well secured most of the time , so we will focus on the guest name, i started by a using a simple XSS payload :

<script>alert(window.origin)</script>

Well this gets reflected back to us , let’s read the front end code :

We see that our payload was encoded and treated like Text rather than part of HTML code .

We could use a Filter Bypass which we’re sure it will work :

https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html

But here let’s try simpe Bypasses , like using HTML event handlers instead of script tags :

Works perfectly :)

Once the XSS is triggered we should get the flag :

That was all for this challenge, see you in the next on :)