PortSwiggerlabs: Reflected XSS into HTML context with nothing encoded

Information :

This lab contains a simple reflected cross-site scripting vulnerability in the search functionality.

To solve the lab, perform a cross-site scripting attack that calls the alert function.

Solution :

This one is pretty straight forward and pretty basic as well.

We just need to find an injectable spot .

In our case it’s the search feature .

A simple payload here will be enough to trigger the XSS .

<script>alert(window.origin)</script>

Perfect , once the XSS is triggered the lab should be solved .

Few things to note , since this is just a Reflected XSS , once we refresh the page , our payload will be gone and we need to inject the field once again .

So the only way a victim can be compromised is by visiting the link where we injected the XSS before , whereas if this was a stored XSS , once our payload is stored it will affect Every user who visits the application without the victim having to click our specific link or anything like that which makes Stored XSS much worse compared to a Reflected one .

That was it for this lab , see you in the next one :)