Tutorial 5 PortSwigger Lab: DOM XSS in document.write sink using source location.search

Hello, everyone! After previously discussing Reflected and Stored XSS, this time we will learn about the third type, which is no less interesting: DOM-based XSS.

In this lab, we will exploit a vulnerability where data from the user's URL flows into a JavaScript function that writes it directly to the web page without adequate filtering.

1. What is DOM-based XSS?

DOM-based Cross-Site Scripting (DOM XSS) occurs when an application contains client-side JavaScript that processes data from untrusted sources insecurely, typically by writing that data back to the Document Object Model (DOM).

In this context, we recognize two important terms:

• Source: JavaScript properties that can be controlled by attackers (for example: location.search).
• Sink (Execution Site): A JavaScript function or DOM object that can execute code if the data entered is malicious (for example: document.write).

2. Lab Description

This lab has search query tracking functionality that uses functions. document.write. This function takes data fromlocation.search (the part of the URL after the question mark) and write it into the attribute src an image element (<img>).

3. Steps for Resolution

Here is a step-by-step guide to completing this lab:

Step 1: Identify the Input Point

1. Open the lab page and enter a random word, such as hacker123, into the search box.
2. Click the Search button.

Step 2: Inspect the JavaScript Code

1. Right-click on the search results page and select Inspect.
2. Find the JavaScript code responsible for displaying the search query. We will find a code block like this:

Step 3: Compiling the Payload Our goal is to "exit" the attribute. src and tag img, then insert a new tag that executes the JavaScript command.

• Use"to close the attribute src.
• Use> to close the tag <img>.
• Enter a new tag, for example <svg>, that has attributesonloadto trigger a functionalert.

Final payload:

"><svg onload=alert(1)>

"><svg onload=alert(1)>

Step 4: Execution

1. Enter payload "><svg onload=alert(1)> into the search box.
2. Click Search.
3. A pop-up alert window will appear, indicating that the attack was successful and the lab is complete.

⚠️Safety and Ethics Warning

• For Educational Purposes Only: This information is for educational purposes only. Never attempt these techniques on someone else's system without their express written permission.
• Use PortSwigger Lab: Always use a secure and legal environment for experimentation.
• Legal Responsibility: Any misuse of this knowledge that results in a violation of the law is the personal responsibility of the individual.