Hello!
I have been stuck on the section Exploiting XSS in websockets in the module “MODERN WEB EXPLOITATION TECHNIQUES” where I have to obtain the admin user’s cookie.
I have a working payload and when I send the payload to the local machine with document.domain I can see the domain, but it does not work with document.cookie because some firewall is preventing me from exfiltrating the cookie.
Has anyone managed to solve this section?
Were you able to obtain the flag?
Unfortunately I haven’t been able to obtain the flag yet
neither do I 
This section is more difficult than the others
Anyone to need help to complete this section, little hint:
Payload: <img src="x" onerror=socket.send(doc...)>
and remember, there are 2 endpoints /userws and /adminws 
Thank you! I managed to solve the exercise now 
Hello everyone, has anyone completed the skill assessment? I needed 1 - 2 tips on how to get the passwords for the users admin and htb-stdnt.
i was try document.cookie but don’t work. Have another idea?
After send about 40 request in about 3s, i have flag!