Introduction

“DOM XSS in innerHTML sink using source location.search” refers to a specific scenario where an attacker exploits the innerHTML property as a potential vulnerability to inject and execute malicious code within the Document Object Model (DOM) of a web page using the source location.search.

Lab Solutions | Practical Work Time DOM XSS in innerHTML sink using source location.search

This lab contains a DOM-based cross-site scripting vulnerability in the search blog functionality. It uses an innerHTML assignment, which changes the HTML contents of a div element, using data from location.search.

To solve this lab, perform a cross-site scripting attack that calls the alert function.

Stepwise Solution of the lab DOM XSS in innerHTML sink using source location.search

Let’s begin without any further delay by clicking the ‘Access the lab’ button.(As you know, most of them)

Here we’re because of to find cross-site scripting (XSS) in innerHTML sink using source location.search.
RIGHT? So to do that we’ve to search for something in search functionality (search box). Let’s give a try with ‘novaexperience’ for test.

Well, after that let’s check what is behind the source code there that can lead DOM XSS.

Nothing special you can see it’s in a span tag. Try with the basic XSS payload we usually use for ‘Reflected XSS’ and see what happens.
<script>alert(1)</script>

It’s taking <script> tag but nothing Reflected. RIGHT? In this scenario let’s try another working payload that will solve this lab.

<img src=1 onerror=alert(1)>

BOOM! We’ve solved the lab successfully. Let’s analyze a little bit what happens inside. For that as always go to dev tools and check below at <span> tag.

Here in payload, we use <img tag that is even shown on the web page after pushing a payload of cross-site scripting (XSS). And as a source we just use src. The main part is alert() function, the reason we got the prompt (pop-up), is that its infectable for DOM XSS in innerHTML sink using source location.search.

In the next article, we will discuss about “DOM XSS in innerHTML sink using source location.search“.

I hope you had loved reading this article after you had completed this article we highly recommend you to study the next article: DOM XSS in jQuery anchor href attribute sink using location.search source, please don’t forget to leave a comment over here and share it with your friends as well, Good Luck!

Thank you for reading, if this article really helps you then do share it with your mates.
And follow @masaudsec on Twitter.

FAQS