PortSwiggerlabs: DOM XSS in jQuery anchor href attribute sink using location.search source

Information :

This lab contains a DOM-based cross-site scripting vulnerability in the submit feedback page. It uses the jQuery library’s $ selector function to find an anchor element, and changes its href attribute using data from location.search.

To solve this lab, make the “back” link alert document.cookie.

Solution :

First we must find the /back link :

We see that we can submit a feedback :

Upon Clicking on it :

We find the Return Path parameter where we can inject :

I first started by injecting a simple payload to see how the server would respond :

<script>alert(window.origin)</script>

Nothing , if we check the source code :

We see that whatever we enter there it gets passed inside the href , href is usually used for links and redirections , it expects https:// and http:// ftp:// … BUT we can instead specify another URL scheme which is ‘javascript:’ This will tell it , instead of fetching the URL , execute this code instead :

Since we control the parameter being passed to the href : ‘.get(‘returnPath’)’

We can just inject this payload instead :

javascript:alert(document.cookie)

This will execute our JS code instead of fetching any external URL .

We’re just abusing how href works :

The lab is solved once the XSS is triggered .

That was all for this lab , see you in the next one :)