Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Google firing range vs portswigger labs

Dan | Last updated: Apr 02, 2021 03:00AM UTC

Hi all, I'm new here so I hope I'm asking in the right place. I'll keep it short and simple! On this lab, we can use the payload in the URL: <img src=1 onerror=alert(document.domain)> https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-document-write-sink-inside-select-element But, on Google's firing range, the same payload gets encoded to: %3Cimg%20src=1%20onerror=alert(document.domain)%3E What's the difference? (I thought modern browsers encoded all tags. Is this a server setting?) Thanks, - Dan

Uthman, PortSwigger Agent | Last updated: Apr 06, 2021 09:38AM UTC

The lab has been designed in a way to bypass this and allow you to insert the payload to complete it. You will notice that the solution mentions the payload - there is some encoding (e.g. the space characters to %20).

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.