Tutorial 6 PortSwigger Lab: Serangan DOM XSS pada sink innerHTML menggunakan lokasi sumber location.

Hello, everyone! We're back again to discuss DOM-based XSS. This time, we'll explore a very interesting scenario involving the use of properties. innerHTML which is unsafe can be a gateway for attacks, even though browsers have built-in protection against tags. <script>.

1.What is it?innerHTML Sink?

In JavaScript, innerHTML is a property used to retrieve or set HTML content within an element. However, innerHTML considered a dangerous sink (execution point) if the data entered comes from an untrusted source (such as a URL).

One thing to note: Unlike document.write, HTML5 specifications prohibit the execution of tags <script> which is entered throughinnerHTML. However, XSS attacks can still be carried out using other elements that have event handlers.

2. Lab Description

This lab has a blog search function that takes input from a URL. (location.search) and display it back on the page using assignmentinnerHTML to an elementdiv.Our job is to trigger the function alert()take advantage of this loophole.

3. Steps for Resolution

Here is a step-by-step guide to completing the lab:

Step 1: Identify the Input Point

1. Open the lab page and enter random text in the search box, for exampletest123.
2. Click Search.
3. Note that the texttest123 appears as a search result.

Step 2: Finding Vulnerabilities (Vulnerability Discovery)

1. Right-click on the search results text and select Inspect.
2. We will see that our input is entered into an element. span ordiv using JavaScript. The code example looks like this:

Step 3: Why Tags <script>Failed? If we try to enter <script>alert(1)</script>,

Step 4: Using Event Handlers (Bypass) Because tags <script>doesn't work, we have to use another element that triggers JavaScript automatically. We will use the tag<img> with attributes onerror.

1. Enter the following payload into the search box:

<img src=1 onerror=alert(1)>

<img src=1 onerror=alert(1)>

2. Click Search.

3. Result: The browser will attempt to load the image from source 1 (which of course does not exist). Because the image fails to load, the event onerror will be triggered and execute the command alert(1). The lab is done!

4. Technical Analysis: Source vs. Sink

• Source:location.search. Data is taken from the URL parameters after the question mark.(?search=...).
• Sink (Execution Site): Property innerHTML. The data is "injected" into the DOM and rendered by the browser as HTML.

Although innerHTML blocking tags <script>, it continues to render other HTML elements. Attackers exploit this by using elements that trigger JavaScript through events such as onload, onerror, oronmouseover.

⚠️ Safety and Ethics Warning

• Use the PortSwigger Lab: This article is intended for educational purposes only. Practice these techniques only at PortSwigger Academy.
• No Unauthorized Access: Any form of testing on the original site without written permission is illegal and violates cyber law.
• Responsibility: Use this knowledge to build more secure applications, not to harm others.