This question is related to a class project involving a team of 2 students against another team of two students. We both have servers with a default plugin that we have a week to patch vulnerabilities in, and another week to attempt to steal information from the other teams server. The server has 2 users and an admin with their passwords hashed on a mysql database on the server. We must gain access to the admin account and also deface the website in some manner.
My teammate and I have located a XSS vulnerability like so:
www.example.com/dir/page.php?speed=--></script></head><script>alert("Problem here"); </script>. What are some common ways in which we could exploit this vulnerability to gain information or deface the website. Also, no users will be logging in and we cannot send a malicious link to anyone because no one will click on it.