PortSwiggerlabs: DOM XSS in document.write sink using source location.search

Information :

This lab contains a DOM-based cross-site scripting vulnerability in the search query tracking functionality. It uses the JavaScript document.write function, which writes data out to the page. The document.write function is called with data from location.search, which you can control using the website URL.

To solve this lab, perform a cross-site scripting attack that calls the alert function.

Solution :

Quick thing to note before we start :

For DOM-based XSS, usually we’re looking for two things: a sink, which renders or executes inserted data , document.write(), innerHTML, eval(), etc. But this by itself is not enough , we need the data being passed to the sink to be controlled by us, for example via window.location (parameters entered in the URL), document.cookie (injecting the cookie), etc.

We have this search field where we can inject :

First i injected a simple payload to test with :

<script>alert(window.origin)</script>

If we check the source code :

We see that first our payload is encoded and treated like a Text , which is returned back to us. So this part is not vulnerable .

We also find a document.write function which takes whatever we inserted in the search field and puts it inside an img src attribute, with no encoding applied.

We can first try to escape the img src tag by adding : “> then adding our payload :

"><script>alert(window.origin)</script>

Ah perfect this worked perfectly , but in case script was blocked we can use HTML event handlers with svg onload .

Back to our lab , once the XSS is triggered we should see that the lab solved .

That was all for this lab , see you in the next one :)