Stored XSS into HTML context with nothing encoded

Platform: PortSwigger | Category: Cross Site Scripting | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Cross Site Scripting

Summary

Walkthrough of the PortSwigger Web Security Academy lab Stored XSS into HTML context with nothing encoded (Cross Site Scripting). This lab demonstrates a cross site scripting vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Cross Site Scripting

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

This time we have a blog website. We have a functionality to post comments.

We can use the following XSS payload in the comment field to perform a stored Xss attack.

 js read-only • copy allowed Copy
<script>alert(1)</script>

Now each time when the page containing the comment is reloaded, it triggers an alert.

Thus the lab is solved.

Key Takeaways / Lessons

• Understanding Cross Site Scripting detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Stored XSS into HTML context with nothing encoded