Easy 4

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: case_sensitive_filter_evasion, javascript_uri_case_bypass

Summary

Walkthrough of the CUSTOM Web Easy 4. XSS challenge where input is placed into an <a href=""> attribute. The escape function filters dangerous patterns but uses case-sensitive regex.

Description

XSS challenge where input is placed into an <a href=""> attribute. The escape function filters dangerous patterns but uses case-sensitive regex.

Analysis

Escape function:

 javascript read-only • copy allowed Copy
function escape(s) {
  if (/script|data|\/|"/.test(s)) { s = '/'; }
  return '<a href="' + s + '">Click ME </a>';
}

Filters (case-sensitive):

• script - blocks <script> and javascript:
• data - blocks data: URI
• / - blocks path traversal and closing tags
• " - blocks breaking out of href attribute ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key weakness: The regex /script|data|\/|"/ is case-sensitive (no /i flag). It only matches lowercase "script" and "data".

Solution

Use uppercase JAVASCRIPT: protocol which bypasses the case-sensitive filter:

Payload:

JAVASCRIPT:prompt('sibears')

The regex doesn't match "JAVASCRIPT" (uppercase), so the payload passes through.

Result:

 html read-only • copy allowed Copy
<a href="JAVASCRIPT:prompt('sibears')">Click ME</a>

When the bot clicks the link, the javascript: URI executes (browsers treat it case-insensitively), triggering the prompt. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering case_sensitive_filter_evasion, javascript_uri_case_bypass was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Easy 4 • Difficulty: Easy