Learning security in the open :)
I’m a Penetration tester. I write up each topic as I learn it
the Vulnerabilities, the Tools, the Concepts that finally clicked
latest Reflected XSS into a JavaScript string with angle brackets HTML encoded
- 111writeups
- 110boxes rooted
- 5Certification
Latest writeups
All writeups-
Easy
Reflected XSS into a JavaScript string with angle brackets HTML encoded
Reflected XSS where the search term is reflected inside a JavaScript string and angle brackets are encoded, solved by breaking out of the string with a quote and using '-alert(1)-' to force the alert to run
Cross-site scripting (XSS) 3 min -
Easy
Stored XSS into anchor href attribute with double quotes HTML-encoded
Stored XSS where the comment author website becomes an anchor href and double quotes are HTML encoded, solved by storing a javascript: URL
Cross-site scripting (XSS) 4 min -
Easy
Reflected XSS into attribute with angle brackets HTML-encoded
Reflected XSS where the search term is echoed into a quoted value attribute and angle brackets are HTML encoded
Cross-site scripting (XSS) 4 min -
Easy
DOM XSS in jQuery selector sink using a hashchange event
DOM XSS where location.hash flows into jQuery's $() selector, solved by framing the lab and mutating the iframe hash on load so a hashchange builds an img tag whose onerror calls print()
Cross-site scripting (XSS) 5 min -
Easy
DOM XSS in jQuery anchor href attribute sink using location.search source
DOM XSS through a jQuery href sink where the returnPath value from location.search lands in the back link
Cross-site scripting (XSS) 3 min -
Easy
DOM XSS in innerHTML sink using source location.search
DOM based XSS where the blog search reads straight from the URL and drops it into an innerHTML sink, solved by sneaking in an image tag that fires alert through its onerror handler
Cross-site scripting (XSS) 3 min -
Easy
DOM XSS in document.write sink using source location.search
search term is read straight from location.search and written raw into an img src attribute via document.write
Cross-site scripting (XSS) 4 min