Stored XSS into anchor href attribute with double quotes HTML-encoded

PortSwigger

Description This lab contains a stored cross-site scripting vulnerability in the comment functionality. To solve this lab, submit a comment that calls the alert function when the comment author name is clicked.

Solve Steps

Step 1: Identify Vulnerability

1. 1. Access the Lab and input any alphabetic character in the comment section
2. Using DevTools, check where the input is saved

Step 2: Break test

1. try simple payload: test"123
2. check where the input is save and HTML break

It means :

• No input sanitize
• Vulnerability chance HIGH

Step 3: Construct the Payload

Since you’re inside an href attribute, you can use the javascript: pseudo-protocol:

Enter this in the Website field:

javascript:alert(1)

Step 4: Test the Exploit

1. Post the comment with the payload
2. View the blog post
3. Click on the author name above your comment
4. The alert pops up

Step 5: Solve the Lab

Once the alert appears when clicking the author name, the lab is marked as Solved.

Important Note

Unlike onmouseover or onclick events, javascript: URIs in href attributes execute when the link is clicked, not automatically. The user must click the author name.