Webverselabs Canal Cove Books Challenge XSS

Scenario :

Canal Cove Books is a neighborhood used-book shop with a search over 40,000 titles. The owner added “security” — strip script, strip on*= handlers. He reads Hacker News now. The one thing he didn’t account for is that not every way to run JavaScript looks like a script tag or an event handler.

Solution :

We first start by exploring the app and navigating it just like a normal user would, check different endpoints , submit forms , just discovering normal workflow of the app.

/Front Page :

This is just a static web page that is returned to us everytime we visit the Dashboard .

/Visits :

Another static web page, nothing to work with here .

/Staff Picked !

Same thing , nothing useful on it .

/Find Request :

This looks more interesting since we are able to submit a form , we might try to inject something into it and hope for the best :)

But first let’s send a normal request and see what we get back :

We don’t really get anything reflected back to us other than the name, for now let’s try injecting a simple XSS payload to see :

<script>alert(window.origin)</script>

If we submit it :

We get nothing back , not even the name, this is normal since most apps will block script tags ( it is also mentionned in the description : “The owner added “security” — strip script” ….)

We can try other payloads that don’t contain script :

<img src="" onerror=alert(window.origin)>

The JS code doesn’t execute but at least now we can see our comment , Progress :)

Looking at Burp, we see that Onerror got filtered as well .

We can try and use a different one , we can use Port Swigger XSS cheat sheet to generate a payload that doesnt contain script nor onerror , we already know img is allowed .

https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

I tried them but apparently it blocks all events handlers not just onerror .

Now Searching for XSS Filter Bypasses we find Plenty that we can use :

https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html

But the one that worked for me was this one :

<svg/onload=alert('XSS')>

Once we submit it :

Perfect , now upon triggering the XSS we should get our flag right after :

That was all for this challenge, see you in the next one :)