Easy XSS Challenge 03 – No Quotes (Detailed Analysis)

This document documents Easy XSS Challenge 03 – No Quotes
https://xss.challenge.training.hacq.me/challenges/easy03.php

The analysis is based on the official training PDF "No Quotes Challenge" and explains how XSS payloads can be executed without using quotation marks.

Challenge Overview

In this challenge, the application applies an input filter that disallows quotation marks (single ' and double " quotes).

This prevents classic payloads such as:

<script>
  alert("XSS");
</script>

At first glance, this appears to block JavaScript execution completely.

Vulnerability Type

Reflected XSS with quote filtering

Root Cause

• Security relies on string-based filtering
• Dangerous JavaScript sinks are still reachable
• Dynamic code execution is allowed
• No contextual output encoding

Why the Filter Fails

JavaScript does not require literal strings to execute code.

Instead of passing strings directly, attackers can:

• Encode strings as character codes
• Reconstruct them at runtime
• Execute them dynamically

Technique – String.fromCharCode()

JavaScript provides the function:

String.fromCharCode();

It converts numeric character codes into strings.

Example:

String.fromCharCode(97, 108, 101, 114, 116);

→ "alert"

Exploitation Strategy

1. Convert the target payload (e.g. alert('XSS')) into character codes
2. Reconstruct the string using String.fromCharCode()
3. Execute the reconstructed string using eval()

Example Payload Logic

eval(String.fromCharCode(97, 108, 101, 114, 116, 40, 39, 88, 83, 83, 39, 41));

No quotation marks are required in the payload itself.

Role of eval()

eval() executes JavaScript code represented as a string.

While powerful, it is extremely dangerous when combined with user input.

Why This Works

• Filters only block specific characters, not behavior
• JavaScript supports runtime code generation
• eval() executes dynamically created code

Defensive Takeaways

• Never rely on character blacklists
• Avoid eval() entirely
• Use context-aware output encoding
• Apply Content Security Policy (CSP)
• Treat all user input as untrusted

Key Learning

If code execution is possible, input filtering alone is never enough.

Understanding encoding-based bypass techniques is crucial for both attackers and defenders.