Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Lab: Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped

PRACTITIONER

This lab contains a stored cross-site scripting vulnerability in the comment functionality.

To solve this lab, submit a comment that calls the alert function when the comment author name is clicked.

ACCESS THE LAB

Solution

  1. Post a comment with a random alphanumeric string in the "Website" input, then use Burp Suite to intercept the request and send it to Burp Repeater.
  2. Make a second request in the browser to view the post and use Burp Suite to intercept the request and send it to Burp Repeater.
  3. Observe that the random string in the second Repeater tab has been reflected inside an onclick event handler attribute.

  4. Repeat the process again but this time modify your input to inject a JavaScript URL that calls alert, using the following payload:

    http://foo?'-alert(1)-'
  5. Verify the technique worked by right-clicking, selecting "Copy URL", and pasting the URL in the browser. Clicking the name above your comment should trigger an alert.

Community solutions

z3nsh3ll
Michael Sommer

Register for free to track your learning progress

The benefits of working through PortSwigger's Web Security Academy

  • Practise exploiting vulnerabilities on realistic targets.

  • Record your progression from Apprentice to Expert.

  • See where you rank in our Hall of Fame.

Already got an account? Login here

Try Burp Suite for Free

Find XSS vulnerabilities using Burp Suite

Try for free