XSS Playground: No Filter

The comment page in this lab shows every comment exactly as it was typed. If a visitor writes markup, the page treats it as markup, and if that markup contains a script, the browser runs it. This is cross-site scripting, and it is one of the most common web flaws there is.

The playground gives you a comment box and a preview frame. The frame is sandboxed, with no access to the real site's cookies or storage, and a simulated session secret is set inside it for this exercise. The filter level for this lab is none, which means the server changes nothing you send.

Your task is to write a comment that makes the page run your own script and reveal the simulated secret using the alert function. The widget notices when the secret is revealed and sends it to the server as proof. The server then hands back the flag.

Think about why this works, and how you would stop it: encode output for the context it lands in, and add a content security policy as a second line of defence.