|
I've been noticing that I can't submit a URL to the stored payloads to the WebSocket XSS lab? My solution works on my machine (I know, that old chestnut) but I can't seem to submit it. |
Replies: 1 comment 1 reply
|
That lab is a stored lab, and you can only submit payload hosting URLs to reflective labs. I've just updated the error message so this is clearer. You can solve this by submitting the target lab URL, and sending websocket messages from your browser that are echoed into the headless browser. I will make a solution video of this at some point. Maybe it should allow payload hosting URLs, but I need to carefully consider the consequences of that. |
|
Hi, thank you for clarifying! The reason I ask is it's possible to solve this using iFrames and CSWH using the payload lab, I didn't realise it was intended to be a stored lab - that's much easier! |
That lab is a stored lab, and you can only submit payload hosting URLs to reflective labs. I've just updated the error message so this is clearer.
You can solve this by submitting the target lab URL, and sending websocket messages from your browser that are echoed into the headless browser. I will make a solution video of this at some point.
Maybe it should allow payload hosting URLs, but I need to carefully consider the consequences of that.