Hard
Cross-Site Scripting
TicketDesk support (stored XSS)
A support desk renders ticket text raw to an admin bot; steal the admin session to reach the flag.
PentestingHere Academy
Official Academy lab
- Attempts
- 7
- Solves
- 4
- Published
- 6 Sep 2026
Scenario
TicketDesk lets you open support tickets. When you "escalate" a ticket, an admin (a headless
browser carrying an admin cookie) opens it in the agent view, where the ticket body is shown
as raw HTML. The flag lives on /admin.php, which needs the admin cookie.
There is a built-in collector to receive data: POST /capture.php?token=<you-pick>&c=<data>
stores it, and GET /view.php?token=<same> reads it back.
Goal
Use a stored cross-site scripting payload to make the admin's browser hand you the contents
of /admin.php, and submit the flag printed there.