Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab - Reflected XSS into HTML context with most tags and attributes blocked

nicchongwb | Last updated: Jun 18, 2021 09:09AM UTC

I tried the following payload and delivering it to exploit server and victim and it is not working. Is there anything that I am missing out or is this a bug in the lab? Thankyou Following payload: <iframe src="https://labid/?search=%22%3C%3Ebody%20onresize=alert(document.cookie)%3E%20onload=this.style.width='100px'"

Ben, PortSwigger Agent | Last updated: Jun 18, 2021 12:56PM UTC

Hi, It seems like you might need to take another look at some of the encoding that you are using in your payload - have you compared your solution against the official solution provided in the lab itself?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.