Introduction to DOM XSS in document.write sink using source location.search

Cross-Site Scripting (DOM XSS) is a type of vulnerability in which an attacker injects malicious code into a web page’s Document Object Model (DOM), which is subsequently executed by the victim’s browser. “DOM XSS in document.write sink using source location.search,” as you indicated, refers to a specific scenario in which the document.write function is utilized as a potential vulnerability.

Lab Solutions | Practical Work Time DOM XSS in document.write sink

This lab contains a DOM-based cross-site scripting vulnerability in the search query tracking functionality. It uses the JavaScript document.write function, which writes data out to the page. The document.write function is called with data from location.search, which you can control using the website URL.

To solve this lab, perform a cross-site scripting attack that calls the alert function.

Stepwise Solution of the lab:-

After accessing the lab you can see there’s a search functionality (search box). We’ve already discussed it in the previous article.

Let’s search for anything to understand the code inside of it via ‘view-source’.

Here, you can see the search functionality has been made by the h1 tag. So let’s give it a try with a simple XSS payload.

<script>alert(1)</script>

As you can see here the <script> tag doesn’t work. they are rendered as literal text and not interpreted as HTML or script code. That’s why it displayed without properly decoding. In this kind of scenario let’s use the brain. And put this payload for DOM XSS.

"><svg onload=alert(1)>

Have a look, BOOM! we’ve successfully solved this lab. In the next article, we will explore more about DOM cross-site scripting (XSS) and its types also that can be performed in real-world web application pen-testing.

I hope you had loved reading this article after you had completed this article we highly recommend you to study the next article: DOM XSS in document.write sink using source location.search, please don’t forget to leave a comment over here and share it with your friends as well, Good Luck!

Thank you for reading, if this article really helps you then do share it with your mates.
And follow @masaudsec on Twitter.

FAQS