Lab: DOM XSS in `document.write` sink using source `location.search` inside a select element

PRACTITIONER

This lab contains a DOM-based cross-site scripting vulnerability in the stock checker functionality. It uses the JavaScript document.write function, which writes data out to the page. The document.write function is called with data from location.search which you can control using the website URL. The data is enclosed within a select element.

To solve this lab, perform a cross-site scripting attack that breaks out of the select element and calls the alert function.

Access the lab

Solution

Use Burp Suite to intercept and modify the request to the stock checking function, containing the storeId parameter.
Enter a random alphanumeric string into the storeId query parameter.
Right-click and inspect the element, and observe that your random string has been placed inside a select element.
Change the URL to: product?productId=1&storeId="></select><img%20src=1%20onerror=alert(1)>

Want to track your progress and have a more personalized learning experience? (It's free!)

In this topic

Cross-site scripting Reflected XSS Stored XSS DOM-based XSS XSS contexts AngularJS sandbox Exploiting XSS vulnerabilities Content security policy Dangling markup Preventing XSS XSS cheat sheet

All topics

SQL injection XSS CSRF Clickjacking DOM-based CORS XXE SSRF Request smuggling Command injection Server-side template injection Insecure deserialization Directory traversal Access control Authentication Web cache poisoning WebSockets

Lab: DOM XSS in document.write sink using source location.search inside a select element

Solution

In this topic

All topics

Find XSS vulnerabilities using Burp Suite

Lab: DOM XSS in `document.write` sink using source `location.search` inside a select element