TryHackMe — NahamStore — Walkthrough

4.1. Enter an URL ( including parameters ) of an endpoint that is vulnerable to XSS

Answer: http://marketing.nahamstore.thm/?error=

4.2. What HTTP header can be used to create a Stored XXS

Answer: User-Agent

4.3. What HTML tag needs to be escaped on the product page to get the XSS to work?

Answer: title

4.4. What JavaScript variable needs to be escaped to get the XSS to work?

Answer: search

4.5. What hidden parameter can be found on the shop home page that introduces an XSS vulnerability.

Answer: q

4.6. What HTML tag needs to be escaped on the returns page to get the XSS to work?

Answer: textarea

4.7. What is the value of the H1 tag of the page that uses the requested URL to create an XSS

Answer: Page Not Found

4.8. What other hidden parameter can be found on the shop which can introduce an XSS vulnerability.

Answer: discount