Screenshots

Home > Xss-Dom > Inject XSS payloads into the search form and verify no script execution > Screenshots

Report generated 04-07-2025 12:58

Juice Shop Is Susceptible To XSS Attacks Feature

1 To 10 Seconds (Duration)

Juice Shop Is Susceptible To XSS Attacks (feature)

Inject XSS payloads into the search form and verify no script execution

Scenario:

When she searches for <payload>
Then she should see no alert message

Inject XSS payloads into the search form and verify no script execution #1 - payload: <script>alert(`XSS`)</script>

When she searches for <script>alert(`XSS`)</script>

Haxxor searches for <script>alert(`XSS`)</script>

Haxxor navigates to "/"

Haxxor waits until Search button does become visible

Haxxor clicks on Search button

Haxxor waits until Search input does become visible

Haxxor enters "<script>alert(`XSS`)</script>" into Search input

Haxxor dismisses next modal dialog window

Haxxor presses key Enter in Search input

Haxxor waits until 'Search results does become visible

Then she should see no alert message

Haxxor ensures that last dialog state does equal "absent"

Inject XSS payloads into the search form and verify no script execution #2 - payload: '"><img src=x onerror=alert(`alert`)>

When she searches for '"><img src=x onerror=alert(`alert`)>

Haxxor searches for '"><img src=x onerror=alert(`alert`)>

Haxxor navigates to "/"

Haxxor waits until Search button does become visible

Haxxor clicks on Search button

Haxxor ensures that true does equal true

Haxxor clicks on Search button (completed)

Haxxor waits until Search input does become visible

Haxxor enters "'"><img src=x onerror=alert(`alert`)>" into Search input

Haxxor dismisses next modal dialog window

Haxxor presses key Enter in Search input

Haxxor waits until 'Search results does become visible

Then she should see no alert message

Haxxor ensures that last dialog state does equal "absent"

Inject XSS payloads into the search form and verify no script execution #3 - payload: <svg/onload=alert(`XSS`)>

When she searches for <svg/onload=alert(`XSS`)>

Haxxor searches for <svg/onload=alert(`XSS`)>

Haxxor navigates to "/"

Haxxor waits until Search button does become visible

Haxxor clicks on Search button

Haxxor waits until Search input does become visible

Haxxor enters "<svg/onload=alert(`XSS`)>" into Search input

Haxxor dismisses next modal dialog window

Haxxor presses key Enter in Search input

Haxxor waits until 'Search results does become visible

Then she should see no alert message

Haxxor ensures that last dialog state does equal "absent"

Inject XSS payloads into the search form and verify no script execution #4 - payload: "><iframe src=javascript:alert(alert)>

When she searches for "><iframe src=javascript:alert(alert)>

Haxxor searches for "><iframe src=javascript:alert(alert)>

Haxxor navigates to "/"

Haxxor waits until Search button does become visible

Haxxor clicks on Search button

Haxxor waits until Search input does become visible

Haxxor enters ""><iframe src=javascript:alert(alert)>" into Search input

Haxxor dismisses next modal dialog window

Haxxor presses key Enter in Search input

Haxxor waits until 'Search results does become visible

Then she should see no alert message

Haxxor ensures that last dialog state does equal "absent"

Inject XSS payloads into the search form and verify no script execution #5 - payload: <body onload=alert(`XSS`)>

When she searches for <body onload=alert(`XSS`)>

Haxxor searches for <body onload=alert(`XSS`)>

Haxxor navigates to "/"

Haxxor waits until Search button does become visible

Haxxor clicks on Search button

Haxxor waits until Search input does become visible

Haxxor enters "<body onload=alert(`XSS`)>" into Search input

Haxxor dismisses next modal dialog window

Haxxor presses key Enter in Search input

Haxxor waits until 'Search results does become visible

Then she should see no alert message

Haxxor ensures that last dialog state does equal "absent": <span class='success-color'>SUCCESS</span>

Serenity BDD version 4.2.34