Fictional Application
Nexus CRM & Lead Manager
Enterprise Sales Pipeline & Client Relationship Management
Nexus CRM allows sales reps to manage client accounts and update company status notes. The primary client detail view properly escapes all user input. However, enterprise applications often display data across multiple views, reports, and administrative logs. Audit the application to find where input is handled unsafely.
🎯 Assessment Objective
Submit a status note, navigate to the internal Audit Log view, and trigger stored XSS where output escaping was omitted.
Educational Guidance: Treat this lab like an authorized penetration test. Analyze user-controlled parameters, review browser source code and developer tools, and discover how input is handled.