diff --git a/app/views/layouts/tutorial/xss/_xss_first.html.erb b/app/views/layouts/tutorial/xss/_xss_first.html.erb index ae77a52..a21419b 100644 --- a/app/views/layouts/tutorial/xss/_xss_first.html.erb +++ b/app/views/layouts/tutorial/xss/_xss_first.html.erb @@ -53,7 +53,7 @@

Stored Cross-Site Scripting ATTACK:

-

When registering, enter your JavaScript tag such as <%= %{} %> in the First Name field. Upon login the header navigation bar will echo "Welcome" + your JS code. You can have your XSS code point the victim to a <%= link_to "BeEF server", "http://beefproject.com", {:style => "color: rgb(69, 126, 136)" } %> and have some fun as well.

Stored Cross-Site Scripting SOLUTION:

@@ -72,7 +72,10 @@

- Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor +

+ Apparently we had some issues rendering people's names with weird formatting or something, I dunno, I think I fixed it by safely encoding html and rendering the necessary content.

+ Your Welcome! +