webeasy

Medium 3 - JSON Injection XSS

spbctf

Task: XSS challenge where input must be valid JSON (validated via JSON.parse), then inserted into JS string with single quotes. Solution: Create JSON with single quote in value to break out of JS string context and execute arbitrary JS.

$ ls tags/ techniques/
xssjson_injectionjs_string_contextjson_parsesibearsxss
json_injection_xssjs_string_breakout
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]