PortSwiggerlabs: DOM XSS in innerHTML sink using source location.search

Information :

This lab contains a DOM-based cross-site scripting vulnerability in the search blog functionality. It uses an innerHTML assignment, which changes the HTML contents of a div element, using data from location.search.

To solve this lab, perform a cross-site scripting attack that calls the alert function.

Solution :

Quick note :

For DOM-based XSS, usually we’re looking for two things: a sink, which renders or executes inserted data , document.write(), innerHTML, eval(), etc. But this by itself is not enough , we need the data being passed to the sink to be controlled by us, for example via window.location (parameters entered in the URL), document.cookie (injecting the cookie), etc.

The cheat sheet and links already have payloads that work for DOM-based XSS, and often the same exact payload string can trigger Reflected, Stored, or DOM-based XSS it just depends on where and how the application inserts your input into the page, not on the payload itself. But it’s good to know the difference.

Now back to the lab :

First let’s inject a simple XSS payload :

<script>alert(window.origin)</script>

We see that our payload gets immediately filtered , maybe Tags are blocked once again .

Checking the Source code :

Huge indicator of a DOM based as we explained earlier .The sink here is .innerHTML, assigned inside doSearchQuery, and we control the input being passed into it, since it comes directly from the search field via (new URLSearchParams(window.location.search)).get(‘search’). getElementById(‘searchMessage’) is just used to locate the target element that receives this unsafe assignment.

Now let’s use a payload that doesn’t use script tags :

<img src="" onerror=alert(window.origin)>

Perfect this executes the payload and we are able to solve the Lab .

That was all for this lab , see you in the next one :)