Lab: DOM-based cookie manipulation

PRACTITIONER

This lab demonstrates DOM-based client-side cookie manipulation. To solve this lab, inject a cookie that will cause XSS on a different page and call the print() function. You will need to use the exploit server to direct the victim to the correct pages.

Access the lab

Solution

Notice that the home page uses a client-side cookie called lastViewedProduct, whose value is the URL of the last product page that the user visited.
Go to the exploit server and add the following iframe to the body, remembering to replace YOUR-LAB-ID with your lab ID:
<iframe src="https://YOUR-LAB-ID.web-security-academy.net/product?productId=1&'><script>print()</script>" onload="if(!window.x)this.src='https://YOUR-LAB-ID.web-security-academy.net';window.x=1;">
Store the exploit and deliver it to the victim.

The original source of the iframe matches the URL of one of the product pages, except there is a JavaScript payload added to the end. When the iframe loads for the first time, the browser temporarily opens the malicious URL, which is then saved as the value of the lastViewedProduct cookie. The onload event handler ensures that the victim is then immediately redirected to the home page, unaware that this manipulation ever took place. While the victim's browser has the poisoned cookie saved, loading the home page will cause the payload to execute.

Want to track your progress and have a more personalized learning experience? (It's free!)

In this topic

DOM-based vulnerabilities DOM clobbering

The benefits of working through PortSwigger's Web Security Academy

Practise exploiting vulnerabilities on realistic targets.
Record your progression from Apprentice to Expert.
See where you rank in our Hall of Fame.

Already got an account? Login here

Lab: DOM-based cookie manipulation

Solution

In this topic

All topics

Find DOM-based vulnerabilities using Burp Suite

Register for free to track your learning progress