July 18, 2026
XSS Bypass — The Hackers Labs
Thank you for taking the time to read through this walkthrough!
By Pavin Das
2 min read
If you are following along, I highly encourage you to use this walkthrough as a reference and try to complete yourself. Hands-on practice is the best way to learn, so try to explore and experiment without copying every step directly.
Challenge Objective
Detecting an XSS on the same sink innerHTML, protected by a weak filter that blocks scriptcommas alerts and quotes, and evading it with template literals and concatenation to execute alert()anyway and obtain the flag.
Step 1:
Open the XSS Bypass lab in the browser. The application contains a search input where user supplied data is reflected back onto the page.
Step 2:
To verity whether the input is vulnerable to XSS, enter a basic payload using the
<script>alert()</script><script>alert()</script>
Step 3:
After submitting the payload, notice that the applicaion removes parts of the input including the <picture> <source media="(max-width: 768px)" srcset="/img/medium/700/1*-MjVeVKvDqZIBU8410oc2w.png 1x"> <source media="(min-width: 769px)" srcset="/img/medium/2000/1*-MjVeVKvDqZIBU8410oc2w.png 1x"> <img src="/img/medium/700/1*-MjVeVKvDqZIBU8410oc2w.png" alt="None" width="1904" height="1042" loading="lazy" data-zoom-src="/img/medium/4000/1*-MjVeVKvDqZIBU8410oc2w.png" class="prose-image"/> </picture>
Step 4:
Since the
<img src=x onerror="alert()"><img src=x onerror="alert()">However, the filter still blocks the payload because it removes the alert keyword, preventing the JavaScript from executing.
Step 5:
To bypass the keyword filter, modify the payload so that the blocked keyword is reconstructed after the filtering process.
The technique involves inserting the filtered word inside the actual keyword. When the filter removes the inserted text, the remaining characters join together to recreate the intended JavaScript function.
<img src=x onerror="alealertrt()"><img src=x onerror="alealertrt()">As a result, the browser interprets the reconstructed keyword correctly, allowing the payload to execute.
Step 6:
Submit the modified payload.
This time, the filter fails to prevent execution, and the JavaScript payload runs successfully. The alert dialog appears, confirming that the XSS filter has been bypassed successfully.
Conclusion
This lab demonstrates that relying on simple keyword-based filtering is not an effective defense against Cross-Site Scripting attacks. Although the application attempted to block dangerous keywords such as
Best of luck on your hacking journey!