Easy XSS Challenge 02 – No Parentheses (Detailed Analysis)

This document documents Easy XSS Challenge 02
https://xss.challenge.training.hacq.me/challenges/easy02.php

The analysis is based on the official training PDF "No Parentheses" and explains how filtering parentheses and event handlers is insufficient to prevent XSS.

Challenge Overview

The application filters user input with the following restrictions:

• Round parentheses ( and ) are removed
• Inline event handlers (on*) are stripped
• HTML tags such as <script> are still allowed

At first glance, this appears to block JavaScript execution.

Vulnerability Type

Reflected XSS with syntax restrictions

Relevant Server-Side Filter

$escaped = preg_replace("/[()]/", "", $_GET['payload']);
$escaped = preg_replace("/.*o.*n.*/i", "", $escaped);

Root Cause

• Reliance on character-based blacklisting
• No contextual output encoding
• Misunderstanding of JavaScript language features

Why the Filter Fails

JavaScript functions can be invoked without parentheses using tagged template literals.

This allows function execution even when () are stripped.

Exploitation Technique – Tagged Template Literals

In JavaScript, functions can be called like this:

alert`XSS`;

This is valid JavaScript and does not require parentheses.

Working Payload

<script>
  alert`XSS`;
</script>

Why This Works

• Backticks (`) are not filtered
• Tagged template literals invoke the function automatically
• The browser executes the injected script

Defensive Takeaways

• Never rely on blacklists for security
• Apply context-aware output encoding
• Avoid inline JavaScript execution
• Use Content Security Policy (CSP)
• Validate input and control execution sinks

Key Learning

Removing characters does not remove language features.

Modern JavaScript offers multiple syntactic ways to execute code.