Xss

Eventless

drag_indicator

info

drag_indicator

inputs

drag_indicator

inspect

Another way

This time both "script" and JavaScript events are blacklisted. But there is still another way to trigger JS execution.

Goal: alert(flag)

Hints

Solution

drag_indicator

waf

INPUT

OUTPUT

drag_indicator

code

drag_indicator

result