Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped

Description

The website in this lab contains a reflected cross-site scripting vulnerability in the search query tracking functionality where angle brackets and double are HTML encoded and single quotes are escaped.

Reproduction and proof of concept

  1. Enter a random alphanumeric string in the search box, then use Burp Suite to intercept the search request and send it to Burp Repeater.

  2. Note the random string has been reflected inside a JavaScript string.

  3. Try sending the payload test'payload and observe that the single quote gets backslash-escaped, preventing you from breaking out of the string.

  4. Try sending the payload test\payload and note the backslash does not get escaped.

  5. Replace the input with the following payload to break out of the JavaScript string and inject an alert:

\'-alert(1)//

  1. Verify the technique worked by right-clicking, selecting “Copy URL”, and pasting the URL in the browser. When you load the page it should trigger an alert.