Lab: Reflected DOM XSS
Summary: PortSwigger's lab demonstrates a reflected DOM XSS flaw in which the server processes a request's data and echoes it in the response, and a page script then writes that reflected data to a dangerous sink. The solution injects a backslash that the site does not escape, so the JSON response's escape of the opening double-quote adds a second backslash, canceling the escaping and closing the search-term string, after which a subtraction operator separates expressions before alert() is called and a closing curly bracket with two forward slashes ends the JSON object early.
Key Takeaway: The bypass depends on a single unescaped backslash turning the server's own JSON escaping against itself, so a control that looks correct on paper can still hand an attacker a working script injection.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026