Lab: Exploiting cross-site scripting to capture passwords
Summary: PortSwigger's lab contains a stored XSS vulnerability in a blog comments function, where a simulated victim user views every comment after it is posted. The intended solution injects a payload that makes anyone viewing the comment send a POST request with their username and password to a Burp Collaborator subdomain, and the lab is solved by using those captured credentials to log in to the victim's account.
Key Takeaway: A single stored comment is enough to harvest credentials from every user who reads it, and the lab's alternative - posting the credentials publicly through CSRF - is noted as far less subtle because it exposes the password and leaves evidence the attack occurred.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026