Stored XSS into HTML context with nothing encoded

Stored XSS in Blog Comments — ENHANCED Write‑Up

🎯 Objective

Submit a blog comment that executes alert() when any user views the post (stored/persistent XSS).

🧪 Lab Context

• Vulnerability type: Stored Cross‑Site Scripting (XSS)
• Injection point: Blog comment form (body field)
• Execution context: Rendered on post view for all users
• Goal validation: Visible JavaScript alert popup (e.g., alert(1))

🔍 Discovery & Approach

1. Locate input: Found comment form under each blog post.
2. Hypothesis: Unencoded/unsanitized HTML is being stored and later reflected.
3. Method: Start with low‑noise, high‑compat payloads → escalate if filtered.

🧪 Payload Test Matrix

Note: For stored XSS labs, the simplest and most portable choice is usually:
Final payload: <img src=x onerror=alert(1)>

✅ Steps to Reproduce

1. Open any blog post and scroll to Add comment.
2. In the comment body, submit:
   html Copy

   <img src=x onerror=alert(1)>

3. Submit the comment and navigate back to the post view.
4. The stored payload is rendered for every viewer → alert(1) fires.

🖼️ Evidence

• Payload submission:
• Alert firing on post view:

🧰 Troubleshooting

• HTML tag stripping? Try attribute breakout then element inject:
  "> <img src=x onerror=alert(1)>
• Quote filtering? Use entity encoding:
  <img src=x onerror=alert(&quot;1&quot;)>
• CSP blocks <script>? Prefer event‑handler payloads (onerror, onload).
• Input length limits? Use minimal payload: <img src=x onerror=alert(1)>.

🛡️ Mitigations (Defender Notes)

• Contextual output encoding (e.g., OWASP ESAPI).
• Sanitize HTML with an allow‑list (DOMPurify in strict mode).
• CSP (default‑src 'self'; script‑src 'self'; object‑src 'none'; base‑uri 'self').
• HttpOnly on session cookies (prevents document.cookie access).
• Avoid dangerous sinks (innerHTML) → use textContent/setAttribute safely.
• Server‑side validation + WAF rules for XSS patterns.

📚 References

• PortSwigger Web Security Academy — Stored XSS
• OWASP XSS Prevention Cheat Sheet
• MDN: Content Security Policy (CSP)

📝 Final Answer (What to Submit)

Use the following stored payload in the comment body:

<img src=x onerror=alert(1)>

When the blog post is viewed, the alert box appears — solving the lab.