Lab: DOM XSS in jQuery Selector Sink Using a `hashchange` Event 

Vulnerability Type: DOM-based Cross-Site Scripting (XSS)   

Attack Vector 

The vulnerable application uses jQuery to dynamically process the URL fragment identifier (`#`) and injects it unsafely into the DOM. By exploiting the `hashchange` event, an attacker can trigger malicious JavaScript execution when the victim interacts with a crafted URL.   

Exploitation Steps 

1. Identify the Vulnerability: 

1. The application listens for the `hashchange` event and uses jQuery to select and manipulate DOM elements based on the URL fragment (e.g., `#example`). 

2. The fragment is inserted into the page without proper sanitization, creating an XSS sink.  

2. Craft the Malicious Payload: 

1. Create an `<iframe>` that loads the target page with a malicious fragment: <iframe src=https://YOUR-LAB-ID.web-security-academy.net/# onload="this.src+='<img src=x onerror=print()>'" ></iframe> 

2. When the `<iframe>` loads, it appends an `<img>` tag with an `onerror` handler to the fragment, triggering the `print()` function. 

3. Deliver the Exploit: 

1. Host the payload on the Exploit Server and click “Deliver to victim”.  

2. When the victim visits the malicious page, the `hashchange` event fires, and the unsanitized fragment executes the payload.  

4. Confirmation: 

1. The `print()` function is called, confirming successful XSS exploitation. 

Mitigation Strategies 

1. Sanitize URL Fragments: Validate and sanitize any input derived from `location.hash` before processing it with jQuery.  

2. Avoid Unsafe jQuery Methods: Replace risky methods like `$()` (selector injection) with safer alternatives like `document.getElementById()`.   

3. Use `data-` Attributes: Store dynamic content in `data-` attributes instead of injecting raw HTML.  

4. Implement Content Security Policy (CSP): Restrict inline scripts and unsafe `eval()` to mitigate the impact of XSS.  

5. Disable `hashchange` Manipulation: If the `hashchange` event is unnecessary, remove or secure its handlers.   

Key Takeaway 

This lab demonstrates how unsafe handling of URL fragments in jQuery can lead to DOM XSS. Attackers exploit the `hashchange` event to inject malicious payloads, bypassing traditional server-side defenses.