09 Lab: Reflected XSS into a JavaScript string with angle brackets HTML encoded

This lab contains a reflected cross-site scripting vulnerability in the search query tracking functionality where angle brackets are encoded. The reflection occurs inside a JavaScript string. To solve this lab, perform a cross-site scripting attack that breaks out of the JavaScript string and calls the alert function.
image.png
"-alert(1)-"
Vemos que nos bloquea, por que el termino de busqueda está dentro de '
image.png
'-alert(1)-'
image.png
image.png
image.png
Previous08 Lab: Stored XSS into anchor href attribute with double quotes HTML-encodedNext22 Lab: Exploiting cross-site scripting to steal cookies

Last updated