XSS Session Hijacking - Cannot identify vulnerable field

HTB Content
1

hello. looking through the topics ive noticed that im not alone with this problem and there is still no solution, that is why kindly ask for your help.

ive tried all provided payloads in the module multiple times, with and without '> ">, but sadly there is still no response in my php server. i receive signal only when going to http://IP directly from browser. should i try other payloads? should i encode them?

looking forward for some hint and thank you in advance

1 Like
2

hi, just want to ask if we solved it, because im stuck in there too

3

One of the payloads given in the module should work, make sure the web application instance is working (cause sometimes it does not) and iterate throught the payloads making sure also your web server IP address is right :wink: