webeasy

Easy 6 - SiBears XSS School

spfctf

Task: XSS challenge with regex character blacklist filtering letters p,r,o,m,t,e and brackets. Solution: Bypass using JavaScript Unicode escapes (\u0065val) in identifiers and hex escapes (\x70) in strings to call eval(prompt("sibears")).

$ ls tags/ techniques/
filter_bypassxssjavascriptevalunicode_escapehex_escapesibearscharacter_blacklist
unicode_escape_in_identifiershex_escape_in_stringsstring_context_breakoutcomment_injectionblacklist_bypass_via_encoding
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]