Today's challenge

In this write-up, I will cover juice-shop's DOM XSS challenge.

The challenge

DOM XSS - 1 star

DOM XSS - 1 star

DOM XSS

In the challenge — on juiceshop — we are given the exact payload to insert in any input field on the web application that would allow it — due to lack of either a blacklist, whitelist or both.

#The payload
<iframe src="javascript:alert(`xss`)">

#The payload
<iframe src="javascript:alert(`xss`)">

I first tried some basic html tags, the heading(

) and script( <picture> <source media="(max-width: 768px)" srcset="/img/medium/700/1*uj_FDkxDGIl3oSaE9Qh--w.png 1x"> <source media="(min-width: 769px)" srcset="/img/medium/2000/1*uj_FDkxDGIl3oSaE9Qh--w.png 1x"> <img src="/img/medium/700/1*uj_FDkxDGIl3oSaE9Qh--w.png" alt="None" width="1919" height="785" loading="lazy" data-zoom-src="/img/medium/4000/1*uj_FDkxDGIl3oSaE9Qh--w.png" class="prose-image" data-caption="failed &#x26;lt;h1&#x26;gt; payload"/> </picture> <picture> <source media="(max-width: 768px)" srcset="/img/medium/700/1*qeAP82mgiStVkIKT0bc-KA.png 1x"> <source media="(min-width: 769px)" srcset="/img/medium/2000/1*qeAP82mgiStVkIKT0bc-KA.png 1x"> <img src="/img/medium/700/1*qeAP82mgiStVkIKT0bc-KA.png" alt="None" width="1919" height="784" loading="lazy" data-zoom-src="/img/medium/4000/1*qeAP82mgiStVkIKT0bc-KA.png" class="prose-image" data-caption="failed &#x26;lt;script&#x26;gt; payload"/> </picture>

As seen from the screenshots, it is likely that the two HTML tags are blacklisted.

I decided to use an empty element like before trying the provided payload.

#The 'empty tag' payload
<iframe src=x onerror=alert(`xss`)>

#The 'empty tag' payload
<iframe src=x onerror=alert(`xss`)>

As seen from the screenshots(PoC screenshots) above, the payload works. This makes me think that the developer failed to blacklist empty elements. Even better, the developer would have made a whitelist.

So, with that the goal has already been achieved.

For the sake of finishing the challenge, I inserted the provided payload which worked as well.

The challenge is done.

I really appreciate your time. Feel free to check the Christmas Special challenge here.