This lab contains a stored cross-site scripting vulnerability in the comment functionality. To solve this lab, submit a comment that calls the alert function when the comment author name is clicked.
Explore the application and understand it :
Basic understanding: Type of Application: Blogging Platform Users can add comments for the posts
Add comments on the post
Click on “Back to blog” link.
The comments were added for the post
It looks like the name is highlighted with colour. It looks like hyperlink
Lets check the page source:
The
nametext is wrapped around the<a>tag withwebsitevalue in itshrefattribute
The input type for the website is text, So I am assuming there is no regex pattern matching for checking the URL pattern, or there is no input validation
Lets try javascript URI to call the js code
Payload Execution:
Explanation: the
javascriptURI calling the alert() function
See the page source
So, the
hrefattribute’s value is completely replace with the malicious xss payload input
in this case the href value is controlled fully,
I tried to break out of the href attribute, but i cannot because the " (double quotes) is HTML encoded. So could not able to break out of the attribute. That’s why I chosen the javascript URI payload to fully replace the href value