# TownWall — Stored XSS (CTF challenge)

> TownWall is a community comment board. New comments are reviewed by a moderator whose client renders them without sanitising.

Canonical: https://codelivly.com/ctf/challenges/townwall-stored-xss

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Medium |
| Points | 350 |
| Estimated time | 20 min |
| Type | Live instance |
| Solves | 38 |
| Author | Codelivly |

TownWall is a community comment board. New comments are reviewed by a moderator whose client renders them without sanitising. Post a comment containing a payload that would execute in the moderator's browser — their session token gets leaked, and that's your flag. (You prove the stored exploit; the app validates it server-side and never runs it on this origin.)

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)