WAF Filter Gauntlet
Three escalating XSS filters. Bypass each stage.
Mission briefing
ShieldWall fronts a comment box with three increasingly strict input filters. Each stage blocks more patterns while still echoing your text into HTML. Reach a successful script execution at every stage without tripping the filters.
Every task in this room is done. Your rank progress just moved forward.
Objectives
- Beat stage 1–3 filters
Task 1 Stage 1 Medium 10 pts
Scenario
ShieldWall stage one strips script tags from guest comments but echoes everything else. Other HTML may still be valid in the output context. Execute JavaScript without using blocked script elements.
Your approach
- Confirm script tags are removed or encoded in responses.
- Try img or similar tags with automatic event handlers.
- Verify alert or equivalent runs in the browser.
- Submit the stage one bypass flag.
Bypass script filter.
Open lab →Hint
<img src=x onerror=alert(1)>
Task 2 Stage 2 Hard 15 pts
Scenario
Stage two also blocks onerror handlers on common tags. Different events or elements may still slip through the filter. Achieve execution using an unblocked event name.
Your approach
- Test which tags and events survive stage two filtering.
- Use onload, ontoggle, or body-level events instead of onerror.
- Trigger execution and confirm the lab marks stage two complete.
- Submit the stage two flag.
onerror is blocked — use another event.
Open lab →Hint
<img src=x onload=alert(1)> or body/input events
Task 3 Stage 3 Expert 20 pts
Scenario
Stage three removes img and svg tags entirely from submissions. Less common HTML elements with event attributes may remain. Find a tag the filter forgets and pop the final alert.
Your approach
- Review blocked patterns after posting sample payloads.
- Experiment with obscure elements like details or marquee with events.
- Achieve JavaScript execution without blocked tag names.
- Submit the stage three flag.
img/svg blocked too.
Open lab →Hint
<details open ontoggle=alert(1)>