XSS Lab #4: Reflected XSS into Attribute

VULNERABLE - Reflected XSS

Lab #4: Reflected XSS into Attribute

Angle Brackets HTML-Encoded - Break Out of Attribute

This lab demonstrates a Reflected XSS vulnerability where user input is reflected inside an HTML attribute value. Angle brackets < > are HTML-encoded, so you cannot inject new HTML tags. Instead, you must break out of the attribute and inject an event handler.

Goal: Inject a payload that breaks out of the quoted attribute and executes alert(1) using an event handler like onmouseover.

VULNERABLE SEARCH - ATTRIBUTE INJECTION

Enter a search term above.

Search Query: (none)

Quick Test Payloads (click or paste):

More Event Handlers:

Shareable URL:
Copy this URL to share the XSS with others!

Hints (click to expand)

Angle brackets < > are encoded, so <script> won't work
Look at the page source - your input is inside a quoted attribute
Try to break out of the quote with " and add an event handler
Payload pattern: "onmouseover="alert(1)
Try different event handlers: onfocus, onclick, onload
Some events need user interaction (mouseover, click, focus)

View Rendered HTML (click to expand)

Solution & Explanation

Why This Works:

The application takes user input and places it directly inside an HTML attribute value. While angle brackets are encoded (preventing new tag injection), quotes are not escaped, allowing you to break out of the attribute and inject event handlers.

Working Payloads:

"onmouseover="alert(1) — Hover mouse over search box
"onfocus="alert(1)"autofocus=" — Auto-triggers when page loads
"onclick="alert(1) — Click the search box
"onload="alert(1) — Fires on element load

Vulnerable Code (What the Server Returns):

<!-- User input reflected inside attribute -->
<input type="text" value="USER_INPUT_HERE">

<!-- With payload: "onmouseover="alert(1) -->
<input type="text" value=""onmouseover="alert(1)">

<!-- Browser interprets as: -->
<input type="text" value="" onmouseover="alert(1)">
<!--                        ^^^^ New event handler! ^^^^    -->

Fix (Secure Code):

// FIX 1: HTML Entity Encode ALL special characters
function escapeAttribute(unsafe) {
    return unsafe
        .replace(/&/g, '&')
        .replace(/"/g, '"')   // Encode double quotes
        .replace(/'/g, ''')  // Encode single quotes
        .replace(//g, '>');
}

// Server-side (PHP example)
$safe_value = htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');
echo '<input type="text" value="' . $safe_value . '">';

// FIX 2: Use template engines with auto-escaping
// React: <input value={userInput} /> (auto-escapes)
// Vue: <input :value="userInput" /> (auto-escapes)

Common Event Handlers for XSS:

onmouseover — Mouse hovers element
onfocus — Element receives focus
onclick — Element clicked
onload — Element finishes loading
onerror — Error occurs on element
onscroll — Element is scrolled
oninput — User types in input

This lab runs entirely in your browser — safe for educational purposes.