← back to room
XSS
XSS Filter Bypass
Scenario
Security added a filter that HTML-encodes angle brackets in the greeting field. Tags like script elements no longer render, but your input still lands in the page markup. Find another way to trigger JavaScript without using blocked characters.
Your approach
- Confirm that literal angle brackets appear as entities in the source.
- Identify an HTML element whose attributes still accept your input.
- Use an event handler that does not require tag injection.
- Trigger execution and read the flag from the lab success area.
- Submit the flag as your answer.
< and > are HTML-encoded, so tag injection fails. Break out of the attribute with a quote and an event handler — the flag will appear.