In dom-xss, you triggered a DOM-based Cross-Site Scripting payload in the NovaCart search bar by writing untrusted data into a client-side innerHTML sink. This lesson covers the two server-mediated variants of the same vulnerability class: reflected and persistent (stored) Cross-Site Scripting.
Unlike DOM XSS, which happens entirely inside the browser, these variants pass through a server. When a user submits data — a search term, a comment, a username — the server either echoes it back inside the HTML it sends as a response, or saves it to a database and serves it to future visitors. If the server writes that data back into the page without converting special characters into safe text, a browser reading the page will treat the attacker's input as markup or code.
The OWASP Top 10 places this class of finding at A03:2021 - Injection.
In this lesson you will:
- Distinguish reflected, persistent, and DOM Cross-Site Scripting by where the payload is stored between submission and execution.
- Deliver a persistent payload through NovaCart's customer feedback form so that it fires every time an administrator opens the feedback view.
- Deliver a reflected payload through a value that the server echoes back inside the HTML response in the same browsing session.
- Inspect the response headers for the application's Content Security Policy and reason about why a strict policy would have blocked the payloads.
- Identify the single mitigation that closes both variants at the same time: contextual output encoding at the sink.
Estimated time: fifteen to twenty minutes.
Prerequisite: the embedded NovaCart application is running and you have a registered account that you have logged in with. If you do not have one yet, the registration form at /vuln/nebula-register is sufficient; no email confirmation is required in the practice environment.
Course position: this is the server-side companion to dom-xss and a preview of the defenses formalized later in input-validation-output-encoding.
Authorization reminder: the payloads in this lesson persist attacker-controlled markup on a database you do not own in production deployments and cause it to execute in another user's session. Restrict your practice to the embedded NovaCart application provided by this course. Running these payloads against a third-party application would constitute unauthorized modification and would be illegal in most jurisdictions.
When you are ready, send the Continue signal.