RXSS-04: Attribute Context — VulnXSS Training Lab

RXSS-04 Attribute Context Easy Unsolved NovaHR Directory

Fictional Application

NovaHR Directory

Internal Corporate Employee Directory

NovaHR provides an internal employee directory where staff members can search for colleagues by name or department. The search input box retains the previously searched string in its `value` attribute so users don't have to retype it. Determine if an attacker can break out of the attribute boundary.

🎯 Assessment Objective

Break out of the `<input value="...">` attribute context and execute arbitrary JavaScript.

Educational Guidance: Treat this lab like an authorized penetration test. Analyze user-controlled parameters, review browser source code and developer tools, and discover how input is handled.

NovaHR People Directory Internal Staff

Dr. Marcus Vance

Principal Systems Architect

Infrastructure • San Francisco, CA

Elena Rostova

Lead Security Engineer

AppSec • Zurich, CH

XSS Successfully Demonstrated!