This month’s challenge was a bit tricky, but still fun nonetheless. The main goal is to bypass CSP protection in a way that is not mentioned elsewhere. Apart from that the challenge offers two more barriers - a CSRF token and an XSS filter. …

February’s XSS challenge is here! On the surface the challenge seems simple but it actually gives light upon two very interesting topics - Javascript labels and Firefox SVG elements. Overview The challenge is represented by an HTML form which collects two things - the name of the user and an answer…

First challenge for 2022 is here by TheRealBrenu. This one is a good example of javascript source maps, which I was unfamiliar at first. However, more on that later. Overview The challenge starts off as a simple page with nothing more than a simple text area and a button. You can…

This year’s Christmas challenge is crafted by E1u5iv3F0x. It was very nice and educational. TL;DR The solution that I came up with consists of two flaws: a weak referrer policy and a best-fit mapping transformation. If you are not familiar with best-fit mapping, here is a brief description from Netsparker. A…

This one is by far one of the hardest challenges that I’ve done. The solution is not as intended but it does include some pretty nice tricks, some of which are borrowed from previous challenges. Overview The challenge is a simple Vue.js app which lists articles of the 2021 OWASP Top…

This is the Halloween edition of Intigriti’s XSS challenge! Overview After reading the rules the following screen appears.

This challenge is a great introduction to prototype pollution and how it works. Overview To start off, let’s see what the challenge is all about. There seems to be some kind of functionality presenting itself as a XSS Cookbook. …

This challenge uses a technique to bypass a restricted charset, similar to the one in jsfuck. Overview The challenge itself is just a simple captcha program, imported inside a frame. The frame contains a form which follows a certain naming pattern, giving each element an ID from the alphabet. …