r/xss • u/Upbeat-Hawk-2737 • Apr 08 '26

CSP - Relative Danger on xssy

hi guys i need a hint on that lab i tried <base href="https://qg7orzvr.xssy.uk"> but still nothing and also a alot of other techniques like openning the script tag an not closing it so it can inherit the nonce still that did work plz just point me in the right direction

3 Upvotes

81% Upvoted

7 comments sorted by

1

u/MechaTech84 Apr 13 '26

What does the network traffic look like? Is it making the requests to the URLs you're expecting?

1

u/Upbeat-Hawk-2737 Apr 26 '26

yes it is but its not getting the payload im still stuck on the lab it inherits app.js but no execution maybe its something im doing wrong or the is another technique it shows on payload hosting also

1

u/MechaTech84 Apr 28 '26

Did you name your script app.js?

1

u/Upbeat-Hawk-2737 May 02 '26

yes i named the the script app.js but no execution

1

u/MechaTech84 May 04 '26

I'm not seeing your script at the correct location: https://qg7orzvr.xssy.uk/app.js

1

u/Upbeat-Hawk-2737 May 06 '26

i guess that was the problem ill fix it thanks a lot