Level 7: Reflected XSS into attribute with angle brackets HTML-encoded

Objective

This lab contains a reflected cross-site scripting vulnerability in the blog's search functionality, where angle brackets (< and >) are HTML-encoded.

To solve the lab, craft an XSS payload that injects a new attribute into an HTML tag and calls the alert() function when triggered.

Explanation

In this scenario, the application reflects the search input directly into an HTML attribute, but with a twist — angle brackets are encoded (< becomes <, > becomes >), which prevents direct HTML injection like <script>.

However, since the context is inside an HTML attribute, and quotes are not encoded, we can break out of the attribute value and inject our own.

This is a classic attribute injection XSS: by closing the existing value with a quote (") and appending a new attribute like onmouseover="alert('XSS')" to an element (e.g., <div> or <img>), we can execute arbitrary JavaScript.

Resolution

1. Perform any search, for example:

   ?search=test

2. Then modify the URL parameter search with the following payload:

   ?search=test"onmouseover="alert('XSS test')

3. Paste the modified URL into the browser and press enter. When you hover over the affected element, the alert() will be triggered.

   ✅ The lab is marked as solved once the alert() successfully pops up.

   

Mitigation

To prevent this type of XSS vulnerability:

• Always properly sanitize and encode user input before inserting it into HTML attributes. Use context-sensitive encoding:

  • Use HTML attribute encoding when injecting data into attribute values.

• Implement a Content Security Policy (CSP) to reduce the impact of XSS attacks.

• Avoid using user input directly in your HTML. Instead, use safe DOM manipulation methods or server-side rendering with proper escaping.

• Consider using a modern JavaScript framework that automatically handles output encoding.