The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: DOM XSS using web messages and JSON.parse

Student921 | Last updated: Jul 21, 2022 01:52AM UTC

Hey, the Solution Payload is following: <iframe src=https://your-lab-id.web-security-academy.net/ onload='this.contentWindow.postMessage("{\"type\":\"load-channel\",\"url\":\"javascript:print()\"}","*")'> Can anybody explain why this time we are using/it only works with single quotes (') around the value of onload and double quotes (") around the parameters while in the previous labs it worked the other way around: <iframe src="https://your-lab-id.web-security-academy.net/" onload="this.contentWindow.postMessage('javascript:print()//http:','*')"> Thanks!

Michelle, PortSwigger Agent | Last updated: Jul 25, 2022 12:21PM UTC