Task 2 : Leave the Cookies, Take the Payload

Steps to find the flags :

Flag 1 steps :

Use this payload in the search section above the message box

<script>alert('Reflected Meow Meow')</script>

Flag 2 steps :

Use this payload in the message box

<script>alert('Stored Meow Meow')</script>

Answer the questions below

Which type of XSS attack requires payloads to be persisted on the backend?

Stored

What's the reflected XSS flag?

THM{Evil_Bunny}

What's the stored XSS flag?

THM{Evil_Stored_Egg}

If you enjoyed diving into the TryHackMe XSS AOC 2025 challenge, you’re going to love what comes next. I break down real-world cyber attacks, walkthroughs, defense tips, and exclusive insights you won’t find on any social feed.

Want to stay ahead in cybersecurity—and never miss a new guide or challenge breakdown?
Join thousands of readers who get my weekly cyber tips straight to their inbox. No spam. No fluff. Just pure, actionable security knowledge.

👉 Subscribe now and level up your skills every week.