Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped

Description

The website in this lab contains a stored cross-site scripting vulnerability in the comment functionality.

Reproduction and proof of concept

  1. Post a comment with a random alphanumeric string in the “Website” input, then use Burp Suite to intercept the request and send it to Burp Repeater.

  2. Make a second request in the browser to view the post and use Burp Suite to intercept the request and send it to Burp Repeater.

  3. Note the random string in the second Repeater tab has been reflected inside an onclick event handler attribute.

<p>
<img src="/resources/images/avatarDefault.svg" class="avatar">                            <a id="author" href="http://whatever" onclick="var tracker={track(){}};tracker.track('http://whatever');">Oi</a> | 26 January 2023
</p>

  1. Repeat the process again but this time modify your input to inject a JavaScript URL that calls alert, using the following payload:

http://foo?&apos;-alert(1)-&apos;

  1. Verify the technique worked by right-clicking, selecting “Copy URL”, and pasting the URL in the browser. Clicking the name above your comment should trigger an alert.