Beginner·150 points·20 solves
Roost — Stored Cross-Site Scripting
Learn stored (persistent) cross-site scripting: when a site SAVES your input and later renders it to other people without escaping, your input runs as code in THEIR browsers — no link or trick needed, just a normal post.
Roost saves each post and renders the body straight into the page for every viewer:
<div class="post"><b>author</b><div>YOUR_POST</div></div>
The body is never escaped, so if YOUR_POST is an HTML tag it becomes a real element in every visitor's page — including the moderator's. That is the difference from reflected XSS: the payload is stored once and fires for everyone who loads the board, so it can attack a victim you never interact with (here, the moderator, whose session token is the flag). The fix is to HTML-escape stored content on output, plus a Content-Security-Policy.
Your tasks
1
Open the board
Click Open lab. Roost shows existing posts and a form to add your own.
2
Post plain text first
Add a normal message and reload. Your post appears verbatim — a hint that the body is not escaped.
3
Post a tag instead of text
Submit a post whose body is HTML the browser executes (a script, or a tag with an event handler) rather than plain words.
4
Let the moderator review it
Reload the board. The moderator reviews stored posts — when your payload executes in their browser, their session token leaks back to the page.
5
Capture the flag
The leaked token banner is the flag. Submit it in the panel.
Submit the flag
Start the lab, capture the flag from the running machine, and submit it here.