> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/xss/xss-contexts/lab-3.md). # Lab 3

## `` HTML anchor element The **``** [HTML](https://developer.mozilla.org/en-US/docs/Web/HTML) element (or *anchor* element), with [its `href` attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/a#href), creates a hyperlink to web pages, files, email addresses, locations in the same page, or anything else a URL can address. Content within each `` *should* indicate the link's destination. If the `href` attribute is present, pressing the enter key while focused on the `` element will activate it. A **canonical tag** is a `` element in the page's `` that tells search engines "the official URL for this page is X." #### What it looks like ```html ``` That's it. Sits in the ``, invisible to users, only relevant to search engine crawlers.

We don't see any input fields for the website, which means the only way to inject anything is through the URL.

Let's try escaping the href quotes - try putting in a alert(1)

The quotes seem to be a little messed up

We added a " ' " right before alert and that seem to fixed it, but it doesn't work why? We need an access key. (plus the description said we needed to activate it using one of the commands) #### `accesskey` — the keyboard shortcut attribute `accesskey` is an HTML attribute that assigns a **keyboard shortcut** to an element. When the user presses that shortcut, the browser treats it as if the element was clicked. #### Basic example ```html ``` Pressing the shortcut (`Alt+S` on Chrome Windows) triggers the button's `onclick`, running `save()`. Same as clicking it. So instead of doing onload, we do onclick and create a access key: ?'accesskey='X'onclick='alert(1)