Easy XSS Challenge 01 – No Alphabets and Digits (Detailed Analysis)

This document documents Easy XSS Challenge 01
https://xss.challenge.training.hacq.me/challenges/easy01.php

The analysis is based on the official training PDF "No Alphabets and Digits" and focuses on how input character restrictions fail to prevent XSS.

Challenge Overview

The application restricts user input by disallowing all alphabetic characters (A–Z, a–z) and digits (0–9). Filtered characters are replaced with spaces.

At first glance, this appears to prevent JavaScript injection entirely.

Vulnerability Type

Reflected XSS with character restrictions

Root Cause

• Security relies solely on blacklisting characters
• No contextual output encoding
• JavaScript execution context is still reachable
• Special characters remain allowed

Character filtering ≠ security

Why the Filter Fails

JavaScript can be written without letters or numbers.

The challenge demonstrates the danger of relying on superficial input validation instead of proper output encoding and execution context protection.

JSFuck – Esoteric JavaScript

The core technique used in this challenge is JSFuck.

JSFuck is an esoteric subset of JavaScript that uses only six characters:

[]!+()

With these characters alone, any JavaScript code can be expressed.

Important JSFuck Primitives

Exploitation Strategy

1. Bypass character restrictions using JSFuck
2. Access the Function constructor
3. Execute JavaScript without using letters or digits
4. Trigger a visible payload (e.g. alert or domain access)

Payload Size Challenge

A full JSFuck version of:

alert("XSS")

results in over 10,000 characters, which is impractical in URLs.

Optimization Strategy

• Avoid string literals
• Use shorter expressions such as:

alert(document.domain)

• Disable unnecessary execution options (e.g. parent scope)

Why This Works

• JavaScript is extremely flexible
• Browsers execute valid JavaScript regardless of how it is written
• Character filtering does not remove execution capability

Defensive Takeaways

• Never rely on character blacklists
• Always use context-aware output encoding
• Avoid inline JavaScript execution
• Apply Content Security Policy (CSP)
• Treat all user input as untrusted

Key Learning

The absence of letters does not mean the absence of code.

Understanding advanced bypass techniques like JSFuck is essential for both attackers and defenders.