# Level 7: Reflected XSS into attribute with angle brackets HTML-encoded

## <mark style="color:purple;">Objective</mark>

This lab contains a **reflected cross-site scripting** vulnerability in the blog's **search functionality**, where **angle brackets (`<` and `>`) are HTML-encoded**.

To solve the lab, craft an XSS payload that **injects a new attribute** into an HTML tag and calls the `alert()` function when triggered.

## <mark style="color:purple;">Explanation</mark>

In this scenario, the application reflects the search input directly into an **HTML attribute**, but with a twist — angle brackets are encoded (`<` becomes `&lt;`, `>` becomes `&gt;`), which prevents direct HTML injection like `<script>`.

However, since the context is **inside an HTML attribute**, and quotes are not encoded, we can **break out of the attribute value** and inject our own.

This is a classic **attribute injection XSS**: by closing the existing value with a quote (`"`) and appending a new attribute like `onmouseover="alert('XSS')"` to an element (e.g., `<div>` or `<img>`), we can execute arbitrary JavaScript.

## <mark style="color:purple;">Resolution</mark>

1. Perform any search, for example:

   ```javascript
   ?search=test
   ```
2. Then modify the URL parameter `search` with the following payload:

   ```javascript
   ?search=test"onmouseover="alert('XSS test')
   ```
3. Paste the modified URL into the browser and press enter. When you hover over the affected element, the `alert()` will be triggered.

   > ✅ The lab is marked as solved once the `alert()` successfully pops up.

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXddtgBMnXUdboyjPpyqJTddvVqhXm0Ks6owfBllquf5vEb9xepuip_eOuOQH2Ev6QGho_6xfOyLPuX-Bud7kDC5Miw18aHGOwUarrrJDYxMHiMYyta6Q-LR4_pTwtRlvy115ydjyg?key=-BCZ-tSX4vSf40JHJNVK-jBl" alt="" width="375"><figcaption></figcaption></figure>

## <mark style="color:purple;">Mitigation</mark>

To prevent this type of XSS vulnerability:

* **Always properly sanitize and encode user input** before inserting it into HTML attributes. Use context-sensitive encoding:
  * Use HTML attribute encoding when injecting data into attribute values.
* **Implement a Content Security Policy (CSP)** to reduce the impact of XSS attacks.
* **Avoid using user input directly in your HTML**. Instead, use safe DOM manipulation methods or server-side rendering with proper escaping.
* Consider using a modern JavaScript framework that automatically handles output encoding.
