PortSwiggerlabs: Stored XSS into HTML context with nothing encoded

Information :

This lab contains a stored cross-site scripting vulnerability in the comment functionality.

To solve this lab, submit a comment that calls the alert function when the blog post is viewed.

Solution :

This one is pretty basic as well , no WAF nor sanitization , which means any payload will work .

Since this is a stored one it’s worse than a Reflected XSS , since once our payload is stored , it will execute on every victim browser as soon as they visit the app , this can be used to steal cookies if HTTP Only isn’t used and perfrom Session Hijacking .

Now back to our Lab :

Now if we visit any of the posts we see that we can leave a comment , this is huge since we can inject our payload there , and if a user visits the post our payload will execute .

First let’s submit a normal comment to see if the comment is returned back to us or whether we need to test for Blind XSS .

Now back to our Blog :

We see that our comment is there , perfect , now i will be injecting a simple payload to test with :

<script>alert(window.origin)</script>

I will be injecting inside the message field , if it doesn’t work i will move to the others, emails are usually always secured .

Now if we go back to the Comment, our payload should execute and we should get the window origin pop as an alert :

And we do :

Now checking the comments :

When the page is loaded, the stored script tag is injected directly into the HTML and executed by the browser, triggering alert(window.origin). Since script tags don’t render visibly, we see the alert pop up rather than the payload appearing as text on the page.

If we refresh the page it will execute again since this is a stored XSS so the payload isn’t stored in the client browser but on the server instead .

That was all for this lab, see you in the next one :)