In this post, we’re going to be solving the lab: “Stored XSS into anchor href attribute with double quotes HTML-encoded”.
In this case, to solve the lab we need to write a comment that calls the alert function when clicking on the comment author’s name.
First of all, let’s access the lab:
Once we access it, we can see that there are different articles, we go into the first one (we could go into any of them):
Once inside, we can observe that there’s a comments section:
So we’re going to write any comment:
When we submit a comment, it’s written and stored on the website. We can observe that in the comment we posted there’s a hyperlink. If we look at its source code, we can observe that the href attribute corresponds to the Website field from when writing a comment:
So knowing this, we can write in the Website field a payload that executes an alert when clicking on the author’s name:
We submit the comment and:
We complete the lab! If we go back to the comments section and observe the source code, we can see how our payload has been placed:
And if we click on test:
It executes!