This lab contains a vulnerability in the comment functionality.
To solve this lab, submit a comment that calls the alert function when the comment author name is clicked.
After accessing the lab, I intercepted the comment request and sent it to the repeater for further analysis:
I noticed that my URL input data was reflected inside an onclick event handler:
I tried injecting a simple XSS payload directly, but it resulted in an error stating "Invalid website." This meant that the URL input needed to maintain a valid format. To exploit this, I decided to close the track function’s parameter, terminate the current statement, and inject my payload, commenting out the remainder to avoid syntax errors.
Here is the approach I used:
Close the track function parameter with ').
Terminate the statement with ;.
Inject the payload.
Comment out the rest with //.
Thus, the payload structure is:
To perform an alert as required by the lab:
Since the application escapes single quotes ('), I used HTML encoding to represent the single quote as '. Additionally, because & could be interpreted as a parameter separator in a URL, I URL-encoded the entire string. The final payload looks like this:
Here is the complete request with the final payload:
After submitting the comment with the crafted payload, I navigated back to the post and clicked on the comment author's name. This action triggered the XSS, and an alert box popped up, indicating the lab was solved successfully.