In this post, we’re going to be solving the lab: “DOM XSS in jQuery anchor href attribute sink using location.search source”:
In this case, to solve the lab we need to execute an alert that returns the cookies.
First of all, let’s access the lab:
Once we access it, we navigate to the submit feedback section, since the statement indicates that’s where the XSS is located:
When we access it, if we look at the URL, we can see that by default the returnPath parameter is added:
Let’s try adding any value to the parameter:
In principle, nothing happens, but if we hover the mouse over the Back hyperlink:
We can see how the value we placed in the variable is implemented in the href attribute of this element. So it’s as simple as placing a payload that executes the alert when we click the button:
javascript:alert(document.cookie)
As we can see, we successfully solve the lab, and from the source code perspective, what we’ve achieved is the following:
Now, if we click on the Back hyperlink:
The JavaScript code we indicated will execute:
In this case, nothing appears because the only cookie we have has the HTTPOnly flag enabled:
This flag enables cookies to only be read from the HTTP protocol and not from JavaScript, it’s a defense mechanism. And with this explained, we’ve completed the lab:
