Lab: Exploiting Reflected XSS into Attribute with Angle Brackets HTML-Encoded 

Introduction 

In this post, we’ll dissect a common Cross-Site Scripting (XSS) vulnerability where user input is reflected into an HTML attribute, but angle brackets (`<`, `>`) are HTML-encoded. This scenario is often encountered in web applications that attempt to sanitize input but fail to fully mitigate XSS risks. We’ll walk through the attack vector, exploitation steps, and mitigation strategies. 

Attack Vector: 

The vulnerability arises when user-supplied input is reflected into an HTML attribute without proper escaping or sanitization. While angle brackets are encoded (preventing direct script injection), the attacker can still break out of the attribute context and inject malicious JavaScript using event handlers like `onmouseover`. 

Example Payload: html: “onmouseover=”alert(1) 

This payload escapes the quoted attribute and injects an event handler that triggers an alert when the mouse hovers over the element. 

Exploitation Steps: 

1. Identify the Reflection Point: 

1. Submit a random alphanumeric string (e.g., Apexium1) in the search box. 

2. Observe that the string is reflected inside an HTML attribute, such as;  

Html; <input value=Apexium1> 

2. Intercept and Modify the Request: 

1. Use Burp Suite to intercept the search request. 

2. Send the intercepted request to Burp Repeater for further manipulation. 

3. Craft the Payload: 

1. Replace the random string with the payload:  

Html: “onmouseover=”alert(1) 

2. The reflected input should now look like 

Html: <input value=”” onmouseover=”alert(1)”> 

4. Verify the Exploit: 

1. Right-click the response in Burp Suite and select “Copy URL”. 

2. Paste the URL into a browser. 

3. Hover over the injected element to trigger the `alert(1)` popup. 

Mitigation Strategies: 

1. Context-Aware Output Encoding: Encode user input based on the context where it’s rendered. For attributes, use HTML attribute encoding (e.g., replace `”` with `&quot;`). 

2. Use Safe APIs: Leverage frameworks or libraries that automatically handle encoding, such as React’s JSX or Angular’s data binding. 

3. Content Security Policy (CSP): Implement a strict CSP to restrict the execution of inline scripts and unauthorized sources. 

4. Input Validation: Validate user input to ensure it conforms to expected patterns (e.g., alphanumeric characters for a search query). 

5. Regular Security Testing: Conduct penetration testing and code reviews to identify and remediate XSS vulnerabilities. 

Conclusion: 

Reflected XSS into attributes with encoded angle brackets is a subtle but dangerous vulnerability. By understanding the attack vector and exploitation steps, developers can better defend their applications. Always prioritize context-aware encoding and robust security practices to mitigate such risks.