Webverselabs Banyan Challenge XSS

Scenario :

Banyan coordinates community-garden plots. The search endpoint strips any space-prefixed on* attribute. The developer assumed all attribute boundaries are whitespace. HTML does not agree.

Solution :

We first browse the app like a normal user , see different endpoints, features then check Burp’s History for interesting Requests that we can tamper with .

/Crops :

Just a static page , no parameters, no useful information for us here.

/Workdays :

Same thing , nothing we can work with here.

/Reserve :

This one is interesting, let’s first submit a normal request :

Now first thing we can try is to inject a payload inside of the notes parameter , for this i used a simple XSS payload :

<script>alert(window.origin)</script>

Weird “<script” got deleted , if we check the code :

Maybe script tags are blocked here , we can always use different ones :

<img src="" onerror=alert(window.origin)>

This time the entire thing got removed , if we check the code :

The moment it reached the space it deleted everything that came after, they also mentionned this in the description “The search endpoint strips any space-prefixed”.

We can try payloads that don’t use spaces or bypass space filters completely , and that won’t include script tags as well obviously .

I found these on Port Swigger’s Website , we can test them :

<img/onerror=alert(1) src=a>
<img/anyjunk/onerror=alert(1) src=a>
<img """><script>alert("alert(1)")</script>">

This worked from the first one .

Now Once the XSS is triggered , we should get our flag .

That was all for this challenge. See you in the next one :)