webmedium

Medium 4 - Double Escape XSS

spbctf

Task: XSS challenge where escape function replaces quotes with backslash-quote but does not escape backslashes. Solution: Use double-escape trick - send backslash before quote to get escaped backslash plus closing quote, breaking out of string context.

$ ls tags/ techniques/
xsssibearsxssescape_bypassdouble_escapebackslash_trick
double_escape_xssbackslash_quote_bypass
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]