PortSwiggerlabs: DOM XSS in innerHTML sink using source location.search

Information :

This lab contains a DOM-based cross-site scripting vulnerability in the search blog functionality. It uses an innerHTML assignment, which changes the HTML contents of a div element, using data from location.search.

To solve this lab, perform a cross-site scripting attack that calls the alert function.

Solution :

Quick thing to note before we start :

For DOM-based XSS, usually we’re looking for two things: a sink, which renders or executes inserted data , document.write(), innerHTML, eval(), etc. But this by itself is not enough , we need the data being passed to the sink to be controlled by us, for example via window.location (parameters entered in the URL), document.cookie (injecting the cookie), etc.

First i injected a simple payload to see how the server will handle it :

<script>alert(window.origin)</script>

We see that our payload gets immediately blocked . If we check the code :

We see that we can’t even find our payload , maybe the script tag is blocked .

For this we can use other payloads that don’t include script tags .

<img src="" onerror=alert(window.origin)>

Perfect , we got our paylaod to execute .

That was all for this lab , see you in the next one :)