---
description: >-
  https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-jquery-href-attribute-sink
---

# DOM XSS in jQuery anchor href attribute sink using location.search source

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F9DhAEwTkAcgTXyjHYAI1%2F1.png?alt=media&#x26;token=3be17e5d-caa9-4dd1-8434-e8df222c70e0" alt=""><figcaption></figcaption></figure>

Let's click on the `Submit Feedback` button.

On the `Submit Feedback` page, we can open the developer tools and inspect the `Back` link.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FV6xTv4qO0BOqSB801nZG%2F2.png?alt=media&#x26;token=fdc96844-6721-47ea-bca9-23b6a2953253" alt=""><figcaption></figcaption></figure>

We can see that it is an `<a>` tag with the `backLink` ID and `href="/"`.&#x20;

Right below it, we can see the script which is responsible for setting it's `href` attribute.

```js
$(function() {
    $('#backLink').attr("href", (new URLSearchParams(window.location.search)).get('returnPath'));
});
```

* `$(function() {...})`: This is a shorthand for `$(document).ready(function() {...})`, which ensures that the code inside the function is executed when the DOM is fully loaded.
* `$('#backLink')`: Selects the HTML element with the ID 'backLink'.
* `.attr("href", ...)`: Sets the 'href' attribute of the selected element.
* `(new URLSearchParams(window.location.search)).get('returnPath')`: Retrieves the value of the 'returnPath' parameter from the URL using the `URLSearchParams` API.

Now that we know how the script works, we can set the `returnPath` parameter in the URI to the following:

```
javascript:alert(document.cookie)
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FVjYDkc3r1aj9xlknPQYY%2F3.png?alt=media&#x26;token=295d764f-53db-4df5-9ef9-0f45d40d1748" alt=""><figcaption></figcaption></figure>

Let's inspect the `Back` link to see if our payload has been inserted.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FEHuvDdLMD7BGHCjOpWLJ%2F4.png?alt=media&#x26;token=118f55c2-abec-4ea6-995a-3497a6c676a3" alt=""><figcaption></figcaption></figure>

Now if we click on the `Back` link, the Javascript that has been inserted in the `href` attribute will be executed.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FtOYMq11Ws55gawir8qDE%2F5.png?alt=media&#x26;token=c32ff488-dfd1-48e7-9408-9f15908effe7" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FboeS5cEbAMwyHW5kyARV%2F6.png?alt=media&#x26;token=e1ca73c3-8025-4e66-9cca-ba99df85d1ad" alt=""><figcaption></figcaption></figure>
