Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped

Description

The website in this lab contains a reflected cross-site scripting vulnerability in the search blog functionality. The reflection occurs inside a template string with angle brackets, single, and double quotes HTML encoded, and backticks escaped.

Reproduction and proof of concept

  1. Enter a random alphanumeric string in the search box, then use Burp Suite to intercept the search request and send it to Burp Repeater.

  2. Note the random string has been reflected inside a JavaScript template string.

<script>
    var message = `0 search results for 'abcdef'`;
    document.getElementById('searchMessage').innerText = message;
</script>

  1. Replace the input with the following payload to execute JavaScript inside the template string:

${alert(1)}

  1. Verify the technique worked by right-clicking, selecting “Copy URL”, and pasting the URL in the browser. When you load the page it should trigger an alert.