-1

I'm currently learning about computer security and in my course we have been asked to create a basic website and demonstrate some basic attack on it.

So, my mission is to demonstrate a stored XSS attack on my website which is based on flask(pythin3.7.2).

enter image description here

enter image description here

enter image description here

Now, the first picture is the python code in which I get the costumer name and email from the HTML form, store them in my DB and then read it back so I can present the user the costumer name that just entered the system

The second picture is the HTML itself and third one is what I feed the website with, as you can see i put a basic HTML command in the "costumer name" field in hope that when the website present it, it will be BOLD... as you can see it just present it as a plain text...

What am I doing wrong?

thanks!!!

lidor
  • 11
  • 4

1 Answers1

0

jinja templates perform html encoding by default. To disable this, add | safe :{{ msg | safe}}

https://jinja.palletsprojects.com/en/2.10.x/templates/#safe

Tohmaxxx
  • 423
  • 2
  • 9