Easy 1

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: js_string_breakout_xss, script_context_xss

Summary

SiBears XSS School challenge. User input is placed inside a JavaScript string in the console.log() function. Goal: execute prompt("sibears").

Easy 1 — Web Kids 2.0 (SiBears XSS School)

Description

SiBears XSS School challenge. User input is placed inside a JavaScript string in the console.log() function. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/1

Analysis

The escape function places user input into a JavaScript string inside a script tag:

 js read-only • copy allowed Copy
function escape(s) {
  return '<script>console.log("'+s+'");</script>';
}

Vulnerability: no escaping of JavaScript special characters (", ), ;). This allows:

1. Closing the string with "
2. Closing the function call with )
3. Adding custom JavaScript code
4. Commenting out the rest of the line with // ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Payload to break out of the JS string and inject XSS:

");prompt("sibears")//

Resulting HTML:

 html read-only • copy allowed Copy
<script>console.log("");prompt("sibears")//");</script>

Breakdown:

• " — closes the string in console.log
• ) — closes the console.log call
• ; — terminates the statement
• prompt("sibears") — our XSS payload
• // — comments out the rest of the line (");) to avoid a syntax error ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍