This lab reflects user input in a canonical link tag and escapes angle brackets.
To solve the lab, perform a attack on the home page that injects an attribute that calls the alert function.
To assist with your exploit, you can assume that the simulated user will press the following key combinations:
ALT+SHIFT+X
CTRL+ALT+X
Alt+X
Please note that the intended solution to this lab is only possible in Chrome.
After accessing the lab and proxying all the requests through Burp Suite, I analyzed the traffic but couldn't find any canonical link tags that I could use. So, I went to the main page and accessed its source code by pressing CTRL+U. By searching for the keyword "canonical," I found this interesting line:
This indicated that the canonical link tag could be vulnerable to a reflected XSS attack through the URL. To exploit this, I decided to use the accesskey attribute and simulate user interaction in Chrome.
The accesskey attribute allows you to define a letter that, when pressed in combination with other keys, triggers events. Knowing that the simulated user will press the following key combinations:
ALT+SHIFT+X
CTRL+ALT+X
ALT+X
I crafted the following payload:
In this payload:
The ? starts the query string for the URL.
The ' closes the href attribute's value.
The accesskey='x' assigns the x access key to the element.
The onclick='alert(1) injects a JavaScript event handler that triggers an alert when the element is clicked.
By accessing this link in the browser, the reflected XSS is triggered when the key combination is pressed, displaying an alert box and solving the lab.