Webverselabs Challenge Porchlight Reflected XSS

Scenario :

Porchlight lends power tools to 300 neighborhood members. Their developer knows you’re supposed to html-escape user input before putting it in a page. She did. The reflection happens to land inside an unquoted attribute — a context where html-escaping angles doesn’t buy you anything.

Solution :

This one is pretty straight forward, only 1 endpoint , if we click on Reserve :

First let’s reserve normally to see if we get anything unsual in Burp’s History .

All the parameters are returned back to us . We first inject the member parameter to see .

<script>alert(window.origin)</script>

Our payload was just reflected back to us without executing . Few assumptions, maybe it is being rendred back to us an HTML comment, script tags are blocked or just the parameter is not vulnerable .

Decided to Inject the other parameter as well but didn’t work either , let’s check the code :

The input is encoded and rendered back to us so the server is treating it like Text . Anyways we can try some Filter Bypasses to see if it works .

https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html

The value attribute is unquoted, allowing attribute injection via whitespace without requiring angle brackets. HTML entity encoding of <> is insufficient here , injecting x onmouseover=alert(window.origin) breaks out of the attribute and executes arbitrary JavaScript when a user hovers the field. This constitutes a reflected XSS via attribute injection.

If we check the code :

The browser reads onmouseover=alert(1) as a real HTML attribute it becomes live JavaScript.

Also there was this payload that worked for me as well from the Filter Bypass cheatsheet .

 <a href="jav   ascript:alert('XSS');">Click Me</a>

This shows that HTML encoding of brackets is not sufficient when user input is reflected inside an existing unquoted HTML attribute. In this context, event handler injection via whitespace (e.g. onmouseover=alert(1)) bypasses encoding entirely, since no angle brackets are required.

That was all for this challenge, see you in the next one :)