Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Solve the Lab: DOM XSS using web messages and JSON.parse without backslashes in the payload.

nonamehash | Last updated: Aug 23, 2022 06:15AM UTC

Hi, when doing the Lab: DOM XSS using web messages and JSON.parse, I constructed a payload (which is: <iframe src="https://lab-id.web-security-academy.net/" onload=this.contentWindow.postMessage('{"type":"load-channel","url":"data:text/html,&lt;script&gt;print()&lt;/script&gt;"}','*')> ). This one does trigger print() when I was viewing the payload in the exploit server, but the lab is not solved. When referring to the solution section, I find that "\"s are added, although the solution provided has the same effect as mine. Is there any problem with my payload, or the verification mechanism of this lab is not well designed?

Liam, PortSwigger Agent | Last updated: Aug 23, 2022 08:31AM UTC

Thanks for your message, nonamehash. Could you provide us with some screenshots of your solution resulting in the print() function being called when the victim loads the page in their browser, please? You can email us via support@portswigger.net.

nonamehash | Last updated: Aug 23, 2022 03:30PM UTC

Hi, thanks for your reply. I've just send the screenshots related to my payload to support@portswigger.net. Check the mail sent by nonamehash@proton.me. Best Regards

Liam, PortSwigger Agent | Last updated: Aug 23, 2022 09:19PM UTC

Thanks. We'll follow up in the email thread.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.