---
description: >-
  https://portswigger.net/web-security/cross-site-scripting/contexts/lab-href-attribute-double-quotes-html-encoded
---

# Stored XSS into anchor href attribute with double quotes HTML-encoded

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FyIKubkafA69isONVKFhw%2F1.png?alt=media&#x26;token=9db63427-90a6-4078-99a9-2db81296792a" alt=""><figcaption></figcaption></figure>

Let's go and comment the following under the post.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fzix0Si5jLr6yMaOZoa5I%2F2.png?alt=media&#x26;token=7e113707-b04e-4312-b806-d63a1745b305" alt=""><figcaption></figcaption></figure>

We can now open `Left CLick > Inspect` to open the developer tools and search our `website.com` payload.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FvTvgM9tLYolqRxId7AyF%2F3.png?alt=media&#x26;token=cfd2477f-f007-48b0-bb42-c55302f91c03" alt=""><figcaption></figcaption></figure>

As we can see, it is being inserted in the `href` attribute of the `<a>` tag.

In order to solve the lab, we have to use the following payload in the `Website` input field:

```
javascript:alert("1");
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FA7y8pD6mk2AX4N4SXulT%2F4.png?alt=media&#x26;token=15f893d1-1b50-4793-a7aa-18e891c776cf" alt=""><figcaption></figcaption></figure>

Let's verify if the payload has been inserted properly.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FVhkCburtsJ1PubGilvLL%2F5.png?alt=media&#x26;token=ca5348a2-2ff6-4ca9-a563-e6c4c4458473" alt=""><figcaption></figcaption></figure>

Now, if we click on the `<a>` tag link, the Javascript will be executed, generating an alert.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F0437f3yCb4ormy8i7pS5%2F6.png?alt=media&#x26;token=88e20c9f-a9b5-4e69-8460-1d531e360972" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FyAV2aJjKJV8APqbT7US1%2F7.png?alt=media&#x26;token=5dc064f6-19ae-4416-aa87-92e25e533b20" alt=""><figcaption></figcaption></figure>
