Apprentice
← all rooms
XSS Hard

Cross-Site Scripting

Learn reflected XSS across HTML, attribute, and script contexts — then bypass a weak filter.

Mission briefing

Welcome to Greetly, a startup that personalises landing pages with the visitor's name. Their marketing team added a quick greeting widget without a security review. Your job is to see whether user-supplied names are handled safely when echoed back in the page.

0 / 4 tasks 0 / 45 pts

Objectives

  • Execute JavaScript via a reflected parameter
  • Break out of an HTML attribute
  • Break out of a JavaScript string
  • Bypass angle-bracket encoding with an event handler
Task 1 Reflected XSS Low 10 pts

Scenario

Greetly's homepage asks for your name and prints a friendly hello right below the form. Whatever you type appears in the HTML body as plain text—or so the developers assume. Your goal is to make the page run your code when a victim opens a crafted link.

Your approach

  1. Open the greeting lab and submit a normal name to see how it reflects.
  2. View page source and locate where your input lands in the DOM.
  3. Try inserting HTML tags that execute JavaScript in that context.
  4. Confirm the lab shows a success banner and copy the flag displayed on the page.
  5. Submit that flag as your task answer.

Open the greeting form and get the browser to run your JavaScript.

Open lab →
Hint

Try injecting a <script> tag into the name field. The flag appears under the greeting.

Task 2 XSS in an Attribute Medium 10 pts

Scenario

The marketing team moved the greeting into a highlighted quote box with a custom tooltip attribute. Your name now sits inside double quotes in an HTML attribute value. Break out of that attribute so the browser still runs your payload.

Your approach

  1. Open the attribute-context lab and note the input field feeding the tooltip.
  2. Inspect the rendered HTML to see quotes wrapping your value.
  3. Craft a payload that closes the attribute and adds an event handler.
  4. Verify JavaScript fires and the lab reveals its flag.
  5. Submit the flag from the success message.

Your input is reflected inside an HTML attribute value.

Open lab →
Hint

Break out with a quote, e.g. " onmouseover="alert(1)

Task 3 XSS in a Script Block Medium 10 pts

Scenario

Greetly added analytics that embed the visitor's name inside an inline JavaScript string. The page assigns your input to a variable before logging it to the console. Escape the string context without breaking the surrounding script syntax.

Your approach

  1. Load the script-context lab and submit a test name.
  2. Find the inline script block containing your reflected value.
  3. Close the JavaScript string and inject a statement that runs your code.
  4. Use comment syntax to neutralise trailing characters if needed.
  5. Capture the flag shown after successful execution and submit it.

The value lands inside an inline JavaScript string.

Open lab →
Hint

Close the string and comment the rest: ';alert(1);//

Task 4 XSS Filter Bypass Hard 15 pts

Scenario

Security added a filter that HTML-encodes angle brackets in the greeting field. Tags like script elements no longer render, but your input still lands in the page markup. Find another way to trigger JavaScript without using blocked characters.

Your approach

  1. Confirm that literal angle brackets appear as entities in the source.
  2. Identify an HTML element whose attributes still accept your input.
  3. Use an event handler that does not require tag injection.
  4. Trigger execution and read the flag from the lab success area.
  5. Submit the flag as your answer.

Angle brackets are encoded. Fire JS another way.

Open lab →
Hint

?name=" autofocus onfocus="alert(1)