PortSwigger
Description
Perform a reflected XSS attack that injects an attribute and calls the alert function. Angle brackets (< >) are HTML-encoded, so you cannot use <script> or <tag> tags.
| Character | Encoded As |
|---|---|
< | < |
> | > |
This prevents you from injecting new HTML tags. However, you can still break out of an existing attribute and inject event handlers
Solution Steps
Step 1: Test with a Random String
- Enter a random alphanumeric string in the search box (e.g.,
test123) - Submit the search
- Inspect the page to see where your input appears
You’ll notice your input is reflected inside a quoted attribute, like this:
Step 2: Construct the Payload
inside a value attribute, you need to:
- Close the quote (
") - Inject an event handler that will execute JavaScript
Enter this payload in the search box:
" onmouseover="alert(1)
After the Enter:
Step 3: Test the Exploit
- Copy the URL from the address bar (right-click → Copy URL)
- Paste it in a new browser tab
- Move your mouse over the search box or the reflected element
- Alert pops up confirming the XSS works
Step 4: Solve the Lab
Once the alert appears on mouse hover, the lab is marked as Solved.
