This lab demonstrates a stored DOM vulnerability in the blog comment functionality. To solve this lab, exploit this vulnerability to call the
To solve this lab, create a comment with the following vector:
<><img src=1 onerror=alert(1)>
replace() function to encode angle brackets. However, when the first argument is a string, the function only replaces the first occurrence. We exploit this vulnerability by simply including an extra set of angle brackets at the beginning of the comment. These angle brackets will be encoded, but any subsequent angle brackets will be unaffected, enabling us to effectively bypass the filter and inject HTML.
The value of the
src attribute is invalid and throws an error. This triggers the
onerror event handler, which then calls the
alert() function. As a result, the payload is executed whenever the user's browser attempts to load the page containing your malicious post.