This lab contains a vulnerability in the submit feedback page. It uses the jQuery library's $ selector function to find an anchor element, and changes its href attribute using data from location.search.
To solve this lab, make the "back" link alert document.cookie.
After accessing the lab, I immediately navigated to the feedback page. The URL looked like this:
https://0a2c000f04ee97e18640097700ee0055.web-security-academy.net/feedback?returnPath=/
I noticed that a returnPath parameter is being passed in the URL.
To understand how the returnPath parameter is being used, I opened the page source code by pressing CTRL+U or using the browser's developer tools (F12). I found the following script tag:
This script uses jQuery to set the href attribute of an element with the ID backLink to the value of the returnPath parameter from the URL.
The script retrieves the returnPath parameter from the URL query string and assigns it to the href attribute of the backLink element. This presents an opportunity for a DOM-based XSS attack if the input is not properly sanitized.
To exploit this vulnerability, I crafted a simple payload using the javascript: URI scheme, which allows for the execution of JavaScript code when the link is clicked:
I constructed the following URL with the malicious payload:
https://0a2c000f04ee97e18640097700ee0055.web-security-academy.net/feedback?returnPath=javascript:alert(document.cookie)
By navigating to the URL with the injected payload and clicking on the "Back" link on the page, the browser executes the JavaScript code in the href attribute, triggering an alert box displaying the document.cookiesolving the lab.