# Roost — Stored Cross-Site Scripting (lab)

> Roost is a neighborhood notice board where residents post messages for everyone to see. Every post is shown to visitors — and to the moderator who reviews the board — exactly as written, with no…

Canonical: https://codelivly.com/labs/stored-xss

| | |
|---|---|
| Type | Web |
| Difficulty | Beginner |
| Points | 150 |
| Session length | 30 min |
| Completions | 20 |

Roost is a neighborhood notice board where residents post messages for everyone to see. Every post is shown to visitors — and to the moderator who reviews the board — exactly as written, with no escaping. Get your post to run as JavaScript in the moderator's browser, and the flag (their leaked session token) is yours.

## Objective

Learn stored (persistent) cross-site scripting: when a site SAVES your input and later renders it to other people without escaping, your input runs as code in THEIR browsers — no link or trick needed, just a normal post.

## Tasks

1. Open the board
2. Post plain text first
3. Post a tag instead of text
4. Let the moderator review it
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)