This lab contains a stored cross-site scripting vulnerability in the comment functionality.
To solve this lab, submit a comment that calls the alert function when the blog post is viewed.
Explore the application and understand it
Basic understanding:
Type of Application: Blogging Platform Users can add comments for the posts
Fields where user can submit inputs:
- comment field
- name field
- email field
- website field
Now, lets fill the details and post an comment.
The comments are displayed here.
Lets check the page source:
Three fields from user inputs are shown in the post’s comment section:
- Comment field
- Name field
- website field
Lets inject the payloads on all these 3 fields and check which one triggers XSS.
Start with simple payloads:
<script>alert('xss')</script>
The xss payload in the name field is just displayed in the page.
Lets check the page source to find the sink
payload string is inserted as it is without any sanitization.
but the Username field is sanitized properly with HTML-encoding
Since the User inputs are not sanitized, the payloads injected into the HTML sink and XSS is executed
Solution:
Always validate the User input and sanitize it before it is processed.