SKF write-ups
Search…
Java - XSS-href

Running the app Java

First make sure java is installed on your host machine. After installation, we go to the folder of the lab we want to practice. "i.e /skf-labs/XSS, /skf-labs/RFI/" and run the following command:
1
$ ./mvnw spring-boot:run
Copied!
Now that the app is running let's go hacking!

Reconnaissance

Step 1

The application invites you to fill a website in the input box, that will be used from the "visit my website!" link to redirect to it.
If we insert https://google.com, and click on "visit my website!" we will be redirected to the Google website. As we can see in the screenshot below our input is reflected in the page inside an href attribute.

Step 2

The next step is to see if we could include JavaScript that can be executed in the href attribute.
href="javascript:JS PAYLOAD"
Autoescape is disabled by default so every characters will be reflected in the following snippet in the template.
1
<center> <p style="font-size:2em;"> <a style="font-size:20px;" th:href="${xss}">visit my website!</a> </p></center>
Copied!

Exploitation

Step 1

Now we have seen where the user input is being reflected in the href, we can craft the payload to trigger an alert box and exploit our XSS.
1
javascript:alert('XSS')
Copied!
and clicking the button, we achieve what we were looking for.

Additional sources

Please refer to the OWASP testing guide for a full complete description about cross site scripting!
https://owasp.org/www-community/attacks/XSS-url/
owasp.org
EJS -- Embedded JavaScript templates