Webverselabs Challenge Rivet & Tack XSS

Scenario :

Rivet & Tack is a two-generation leather shop out of Millerton — belts and dog collars from $48, custom saddle work by appointment, founded 1986. The order-lookup page was bolted on by the owner’s nephew, a high-school junior who’d just discovered View Source and was prouder of how the markup read than of what the browser would do with it.

Solution :

Clicking on Story returns a static page , Goods returns the first page , and if we click on Monogram :

We don’t control the Piece parameter since it’s already pre written , we can’t enter anything ourselves (if you send it then intercept the request and inject inside the Piece parameter that doesn’t change anything as well ).

But we are able to enter our Initials :

We see that we can enter waaay beyond the character limit which is supposed to be 4 as they mentionned .

Now i started by using a very simple XSS payload :

<script>alert(window.origin)</script>

But it is just rendered back to us without executing , if we check the front code :

We see that our brackets are encoded and the payload is just returned back to us . Maybe there is a filtering in place for the script tags , to bypass this we can use HTML event handlers instead once again .

We can first try this one withou script :

<img src="" onerror=alert(window.origin)>

This didn’t work either , let’s just try and use other events , maybe it will work :

\<a onmouseover="alert(document.cookie)"\>xxs link\</a\>

On mouse over works perfectly , upon triggering the XSS, we will get our flag :

That was all for this chllenge, see you in the next one :)