XSS 02
This exercise is one of our challenges on Cross-Site Scripting
In this lab, we delve into bypassing basic XSS filters put in place by web developers. The challenge is to generate an alert box with your unique identifier, even when the developer has implemented regular expressions to filter out simple XSS payloads. By experimenting with the case of the string, such as using instead of
, you can bypass these filters and achieve the desired result.
To complete the challenge, you will need to find the injection point, inject the script tag, and observe how it gets blocked. Then, by modifying the case of the script tag, you can successfully create the alert box. Once you have the working payload with your unique identifier, you will get the automated victim to visit the payload, triggering the alert and completing the challenge.