Last updated
Was this helpful?
As usual the first step is to analyse the application, we have comment form so we fill it with random string like xxxx then open the developer tools and find where the user input is located in the html
so the xss payload could be injected within the onclick event handler
When the XSS context is some existing JavaScript within a quoted tag attribute, such as an event handler, it is possible to make use of HTML-encoding to work around some input filters.
When the browser has parsed out the HTML tags and attributes within a response, it will perform HTML-decoding of tag attribute values before they are processed any further. If the server-side application blocks or sanitizes certain characters that are needed for a successful XSS exploit, you can often bypass the input validation by HTML-encoding those characters.
in this lab the application escapes single quote characters, so we can use the following payload to break out of the JavaScript string and execute your own script:
and we have solved the lab
