I am trying to solve this exercise.
The objective of this is to "Post the Username and Password to Attacker Controlled Server".
There is a
url parameter that the server takes, and it gets reflected back onto the page. Which is what we need to use as the XSS vector.
Now, I have written a script like this:
The injection works fine as I can see the script reflected back onto the page. However the script payload does not send the credentials to the attacker controlled server. Any suggestions?