Hacker101 CTF: Micro-CMS v1 Part 2

Now moving on to the next challenge.

Here we have something to click on :D. First what I did was clicked on all


Testing had some static text, while Markdown Test included one button but nothing was working there. Next, in create page there was some form we can fill up. This looks exciting, because form means we can inject some XSS script. But this needs to be tested, so what I did was, created a page with title "Just for Fun" and description "This text is written just for fun." and the effect was? My text was stored there and home page had indexed my title as well.


This indicates that store-XSS could be possible. So let's create a new page and include XSS thing in the title.

XSS Test<script>alert(1);</script>

The page will be created. Now if you go to your home page Voila! there is a flag.

To get the flag you can also edit the page you created last time to include script like above.