Stored XSS in onclick. Payload obfuscation with HTML encoding.
Here we run a stored XSS attack on a lab that has a number of protections in place in the form of HTML encoding and escaping. The full title of this lab is 'Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and backslash escaped'.
We'll see an example of how HTML encoding can be used for payload obfuscation.
In the post analysis section we also learn some differences regarding the DOM and the raw HTML response returned by the web server.
Support This Channel
======================
Please like and subscribe, it means a lot!
Please buy me a coffee so I can continue to make content.
https://buymeacoffee.com/zenshell
Join our Discord
/ discord
00:00 Introduction
00:21 Exploring the lab
02:13 Demonstrating escaping
03:44 Manual escaping
04:34 Ofuscation of payload with HTML encoding
05:31 Post analysis