This lab contains a simple reflected cross-site scripting vulnerability in the search functionality.
To solve the lab, perform a cross-site scripting attack that calls the alert function.
There is an search feature in the page:
Search something and click on “Search” button:
The Search string “xyz123” displayed in the page.
Lets check the page source, to see if how the searched string is passed into the HTML sink.
>The sink is <h1> tag. and withing an '' single quotes.
Payload
Lets try the simple payload:
<script>alert('XSS exec')</script>
click on “Search” button
XSS executed.
Check the page source:
No input sanitization for the user input searched string, hence vulnerable payloads resulted into XSS execution.
Solution:
Sanitize all inputs received from the User.