Reflected XSS in a JavaScript URL with some characters blocked - Explaining the Payload

This is a fairly tricky XSS lab with the title 'Reflected XSS in a JavaScript URL with some characters blocked'.

We break down the payload into sections and explore the underlying JavaScript to get a full understanding of how the payload works.

Support This Channel
======================

Please like and subscribe, it means a lot!

Join our Discord

00:00 Introduction
00:31 Analysing the decoded payload
03:13 Javascript Throw
05:55 Onerror = alert
07:50 The arrow function
09:50 toString = x
12:36 The injection
15:03 Superfluous function arguments
20:17 Exiting the injection
21:03 Solving the lab
21:42 Post analysis

[marcr]

Thank you for your exhaustive step-by-step explanation. The PortSwigger explanation is definitely not enough. Your videos allow us to appreciate the tricks used in this exploit.

[mehrabamv]

You're the best at explaining the lab and XSS—I absolutely love your explanations!

[pinkypink]

This is extremely helpful! I am not really familiar enough with js, but i really wanted to understand this lab, and it would be so bad without your explanation. Thank you million times!

[sabarishAB-yo]

Best Explanation Ever !!! Really Crazy and very simple to understand and I wish you the very Best !!!

[souravpaul_per]

this is a god level explanation. Thanks sir🙏🙏

[Paul-Dirac]

Amazing! I would have changed the last 'x' by another letter just to not get confuse with the function x previously defined, for example, , window+'',{a:' also works. Thanks for these videos.

[normaliteeos]

JUST ABSOLUTE CRAZY EXPLAINATION! SUPER SIMPLIFIED!!!

[andre-njx]

Thank you so much for this video, everysince I found your channel you have been my savior to understand some of the experts labs. So really thank you so

[Mr.Manimal]

Really well done course! Thanks for your content!

[pv]

Dude, This is really great, You are clearly explaining with custom code, thank you

[.sayanthsunil]

thanks alot man this is great . i mean awesome to give us a detailed explanation🔥

[mohsinhafeez]

BEAUTIFULLY explained, thank you very much!

[Sofi-pszc]

Really amazing and detailed explanation! Thank you!

[YousefAmmar-td]

Absolutely splendid explanation, thank you so much

[akemi-ihky]

Thanks a lot! detailed and clear, satisfactory indeed.

[scharfer]

Thank you! There is one thing that I would like explained. When you pass in the correct query param to solve the lab, and you look at the HTML of the returned response, it does not look like the code passed in the query string was successfully injected. e.g. you do not see an actual single quote to close the value of the body property in the fetch payload. Instead, you see an encoded single quote, which is not valid javascript.

I guess the browser decodes the javascript url before executing it, but I do wonder about that.

[pranjalruhela]

I could see the reflection point in the source.... that's it then I am for the video.., ...I still couldn't understand why the tostring and window are required in our payload...

[ossamayasser]

Thanks for this great explaination♥
I have a question, how does the javascript worked while the equal signs are encoded?

[neadlead]

Nice one I have 1 question and one comment, the question is that how the xss happens when the url is encoded and the payload is also encoded, and the comment is that it's not the parameter that is vulnerable but the url being reflected in the page