Skip to content
SudoSecurity

Sections

intermediate · web-security · 150 points · 0 working it

XSS Hunter: Find, Prove, Fix

A comment field renders user input straight into the DOM. Confirm the sink, prove execution without an alert() popup, then name the fix. Payloads here are for the lab sandbox only — never test against systems you do not own.

  1. Confirm the sink

    Comments render via element.innerHTML = comment. Anything that becomes live DOM is a sink. Checkpoint: the property doing the write — one word, lowercase.

    Which DOM property writes the comment as live HTML?

    Hint

    It parses strings as markup rather than text.

    Sign in to verify this checkpoint.

  2. Prove it without alert()

    Real hunters prove execution quietly. <img src=x onerror=...> fires when the image fails to load. Checkpoint: the event attribute that runs your JS.

    Name the img event attribute that executes JS on load failure.

    Hint

    It starts with 'on'.

    Sign in to verify this checkpoint.

  3. The fix

    Escaping means treating input as text, not markup. Setting element.textContent = comment renders the payload harmlessly. Checkpoint: the safe property — one word.

    Which DOM property inserts text without parsing HTML?

    Hint

    The text sibling of the step-1 sink.

    Sign in to verify this checkpoint.