XSS
Medium · Stored XSS

The Guestbook That Never Forgets

HackerMart runs a public guestbook. Whatever you post is saved on the server and shown to every visitor — including the site admin, who checks in periodically. Post something that only misbehaves when the admin is looking.

Objective

Plant a payload in the guestbook that fires when the admin visits.

Target

HackerMart

Launch target

Submit flag