DOM XSS using web messages and a JavaScript URL

Description

This lab demonstrates a DOM-based redirection vulnerability that is triggered by web messaging. To solve this lab, construct an HTML page on the exploit server that exploits this vulnerability and calls the print() function.

Approach

After accessing the lab, I examined the home page code by pressing CTRL + U and discovered an interesting script:

<script>
	 window.addEventListener('message', function(e) {
		var url = e.data;
		if (url.indexOf('http:') > -1 || url.indexOf('https:') > -1) {
			location.href = url;
		}
    }, false);
</script>

This script has an event listener that listens for web messages. If the message contains 'http:' or 'https:', it assigns the message to location.href. Knowing this, I realized that since the web message is directly passed to location.href, I could use the javascript:print() payload to trigger the XSS. To meet the condition, I needed to include one of the strings, so my payload would be javascript:print()//http:.

Next, I needed to create an exploit page hosted on the exploit server. This page would have an iframe containing the vulnerable website and an event handler that sends my payload in a web message.

Here’s the code for my exploit page:

<iframe src="https://0a9800b803cda767817d11260004001c.web-security-academy.net" onload="this.contentWindow.postMessage('javascript:print()//http:','*')" style="height: 700px; width: 1000px">

By embedding this HTML code in the body of the exploit server and clicking "Deliver exploit to victim," the lab is solved.