PortSwiggerlabs: Stored XSS into anchor href attribute with double quotes HTML-encoded

Information :

This lab contains a stored cross-site scripting vulnerability in the comment functionality. To solve this lab, submit a comment that calls the alert function when the comment author name is clicked.

Solution :

First we submit a normal comment to see how the app behaves :

Once we submit it we’re redirected to this page :

If we go back to check all the comments :

Everything looks normal , but when we specify a website inside the comment :

Now if we check the code :

We see that our website is directly injected inside the href , while href is mainly used for redirections , we can also specify a different URL scheme other than HTTP,HTTPS,ftp://,etc… , which is javascript:

So our payload will simply be :

javascript:alert(XSSS)

Now if we follow the redirection , and then go back to the post :

As soon as we submit our payload :

We will see that the lab is solved .

This happened bcs developpers allowed us to inject arbitrary links to the app , which can usually be abused to execute JS code as well directly .

That was all for this lab , see you in the next one :)