Easy 2

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: html_tag_breakout_xss, img_onerror_xss, textarea_escape_xss

Summary

SiBears XSS School challenge. User input is placed inside a <textarea> tag. Goal: execute prompt("sibears").

Easy 2 — Web Kids 2.0 (SiBears XSS School)

Description

SiBears XSS School challenge. User input is placed inside a <textarea> tag. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/2

Analysis

The escape function places user input between opening and closing textarea tags:

 js read-only • copy allowed Copy
function escape(s) {
  return '<textarea>' + s + '</textarea>';
}

Vulnerability: textarea content is normally interpreted as text, but if we can close the textarea tag, the subsequent HTML will be interpreted by the browser as regular HTML. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Textarea specifics:

• Everything inside textarea is displayed as text
• But the closing tag </textarea> terminates this context
• After it, arbitrary HTML can be injected

Solution

Payload to escape from textarea and inject XSS:

</textarea><img src=x onerror=prompt("sibears")>

Resulting HTML:

 html read-only • copy allowed Copy
<textarea></textarea><img src=x onerror=prompt("sibears")></textarea>

Breakdown:

• </textarea> — closes the textarea tag
• <img src=x — creates an img element with non-existent src
• onerror=prompt("sibears") — error handler for failed load
• The extra </textarea> at the end is ignored by the browser ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍