Lab: Stored DOM XSS

PRACTITIONER

This lab demonstrates a stored DOM vulnerability in the blog comment functionality. To solve this lab, exploit this vulnerability to call the alert() function.

Access the lab

Solution

To solve this lab, create a comment with the following vector:

<><img src=1 onerror=alert(1)>

In an attempt to prevent XSS, the website uses the JavaScript replace() function to encode angle brackets. However, when the first argument is a string, the function only replaces the first occurrence. We exploit this vulnerability by simply including an extra set of angle brackets at the beginning of the comment. These angle brackets will be encoded, but any subsequent angle brackets will be unaffected, enabling us to effectively bypass the filter and inject HTML.

The value of the src attribute is invalid and throws an error. This triggers the onerror event handler, which then calls the alert() function. As a result, the payload is executed whenever the user's browser attempts to load the page containing your malicious post.

Want to track your progress and have a more personalized learning experience? (It's free!)

In this topic

Cross-site scripting Reflected XSS Stored XSS DOM-based XSS XSS contexts AngularJS sandbox Exploiting XSS vulnerabilities Content security policy Dangling markup Preventing XSS XSS cheat sheet

All topics

SQL injection XSS CSRF Clickjacking DOM-based CORS XXE SSRF Request smuggling Command injection Server-side template injection Insecure deserialization Directory traversal Access control Authentication Business logic vulnerabilities Web cache poisoning WebSockets Information disclosure

Lab: Stored DOM XSS

Solution

In this topic

All topics

Find XSS vulnerabilities using Burp Suite