PortSwiggerlabs: Reflected XSS into attribute with angle brackets HTML-encoded

Information :

This lab contains a reflected cross-site scripting vulnerability in the search blog functionality where angle brackets are HTML-encoded. To solve this lab, perform a cross-site scripting attack that injects an attribute and calls the alert function.

Solution :

Again we’re given a search field where we can inject :

Before injecting i put a normal string just to see how it is being processed by the app .

Looking at Burp, we see the value=”aaa” that was our input , what if we add another “ before the string we just inserted will we break our of the quotations?

"<image onmouseover="alert(1)" style=display:block>test</image>

Perfect we are able to break out of the quotations , now we just inject our XSS payload but add “ at the beguinning :

Perfect we’re able to trigger the XSS after we put our mouse over the field (since we’re using the mouse over event handler ) .

To generate all sort of XSS payloads i used this Portswigger XSS cheat sheet .

https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

We can customize our payload for different scenarios .

That was all for this lab, see you in the next one :)