XSS Playground: Basic Filter

The comment page has been patched. Its developer noticed the obvious attack, in which a comment includes a script element, and added a filter. The filter level for this lab is basic.

Filters that look for a known bad pattern have a well-earned reputation for being bypassable. HTML is forgiving about spelling and structure, and scripts can run from places other than a script element. Your task is the same as before: run your own script inside the preview frame, reveal the simulated session secret with alert, and let the widget submit it as proof.

Begin by finding out what the filter removes. Send a harmless test and read the rendered result, then test one construct at a time. The result usually shows you exactly what the filter looks for, and therefore what it forgets.

The frame is sandboxed with an opaque origin, so nothing you do can touch the real site. When the proof is accepted, the flag is shown. Afterwards, consider the proper fix: contextual output encoding, not a list of forbidden strings.