mm0@home:~$

[xss] lab stored xss into anchor href attribute wi b2fa26213f2e496d978f2cccddbbf8ba

[XSS] Lab: Stored XSS into anchor href attribute with double quotes HTML-encoded


Untitled

since the lab mentions clicking on the author name and it uses a href since the website is not enforcing a website input therefore it doesn’t HTTP://websitename.com

so because of this, we can use this input with the javascript: protocol

so for the website we input “javascript:alert(1)”

Untitled

the HTTP://test.com at the end it optional but we are able to add it since we comment it out with the ‘//’

Untitled