Try Hack Me
  • Try Hack Me
  • Rooms
  • Tutorial
    • Welcome to TryHackMe
    • Welcome
    • Tutorial
    • Starting Out In Cyber Sec
    • Welcome
  • Capture The Flag
    • Advent of Cyber
      • Task 1 - 10
      • Task 11 - 20
      • Task 21 - 29
      • PDF - materials
    • Anonymous
    • Mnemonic
    • Bounty Hacker
    • Ignite
    • Pickle Rick
    • Simple CTF
    • Agent Sudo
    • Mr. Robot
  • Advent of Cyber II
    • A Christmas Crisis
    • The Elf Strikes Back!
    • Christmas Chaos
    • Santa's watching
    • Someone stole Santa's gift list!
    • Be careful with what you wish on a Christmas night
    • The Grinch Really Did Steal Christmas
    • What's Under the Christmas Tree?
    • Anyone can be Santa!
    • Don't be sElfish!
    • The Rogue Gnome
    • Ready, set, elf.
    • Coal for Christmas
    • Where's Rudolph?
    • There's a Python in my stocking!
    • Help! Where is Santa?
    • ReverseELFneering
    • The Bits of Christmas
    • The Naughty or Nice List
    • PowershELlF to the rescue
    • Time for some ELForensics
    • Elf McEager becomes CyberElf
    • The Grinch strikes again!
    • The Trial Before Christmas
    • Thank You
  • Linux
    • Linux Fundamentals Part 1
    • Linux Fundamentals Part 2
    • Linux Fundamentals Part 3
    • LinuxCTF - Linux Challenges
    • Learn Linux - wip
    • Find - wip
  • Windows
    • Intro to Windows
  • OSINT
    • Introductory Researching - wip
    • Google Dorking
    • OhSINT
    • Sublist3r
    • Searchlight - IMINT
    • Geolocating Images
  • Crypto
    • Hashing - Crypto 101
    • Encryption - Crypto 101
    • CrackTheHash - wip
  • Network
    • Introductory Networking
    • Nmap
    • Network Services - wip
    • Network Services 2 - wip
    • Networking - wip
    • Nmap - wip
    • TOR
  • Web
    • Web Fundamentals
  • Pentest
    • Pentest questionaire
  • Hardware
    • Dumping Router Firmware
  • HELP
  • Reverse
    • Reversing ELF
Powered by GitBook
On this page
  • Video
  • Resources
  • Challenge
  • Deploy your AttackBox
  • What vulnerability type was used to exploit the application?
  • What query string can be abused to craft a reflected XSS?
  • Launch the OWASP ZAP Application
  • Run a ZAP (zaproxy) automated scan on the target. How many XSS alerts are in the scan?
  • Explore the XSS alerts that ZAP has identified, are you able to make an alert appear on the "Make a wish" website?

Was this helpful?

  1. Advent of Cyber II

Be careful with what you wish on a Christmas night

Web Exploitation

PreviousSomeone stole Santa's gift list!NextThe Grinch Really Did Steal Christmas

Last updated 4 years ago

Was this helpful?

Video

Resources

Challenge

Deploy your AttackBox

No answer needed

What vulnerability type was used to exploit the application?

Stored cross-site scripting

What query string can be abused to craft a reflected XSS?

q

Launch the OWASP ZAP Application

No answer needed

Run a ZAP (zaproxy) automated scan on the target. How many XSS alerts are in the scan?

2

Explore the XSS alerts that ZAP has identified, are you able to make an alert appear on the "Make a wish" website?

No answer needed

Check out this awesome guide about XSS: Common payload list for you to try out: For more OWASP Zap guides, check out the following room:

OWASP/CheatSheetSeries
swisskyrepo/PayloadsAllTheThings
payloadbox/xss-payload-list
Learn OWASP Zap