Evasion ladder

levels 3–4

Somebody reported the script payload before you — this filter removes it (and on this level: more). Your job is finding what it forgot.

Active filter:

Script stripped — event handlers forgotten

Switch level: Level 3 Level 4
Method — inventory what the filter LEFT behind
  1. <u>test</u> first, as always: HTML injection is live on all levels here.
  2. Script dies everywhere on these levels. So interrogate the survivors: send a whole arsenal of tags at once (<img>, <iframe>, <a>, <svg>…) and read the source view to see which came back untouched.
  3. Level 3: if a tag survives, attach a handler — <img src=x onmouseover=alert(1)>. Filters patched for script forget the handler attributes all the time.
  4. Level 4: handlers are rewritten too (watch the source view). New question: how else does JavaScript execute without handlers and without a script tag? Attribute values that accept URLs — iframe src, a href — take javascript: and are the classic forgotten vectors.
  5. Sanity: no-CSP page, so both vectors run on click/hover/load. Note which needs interaction — that's your report's trigger description.
Spoiler — Level 3: surviving tag plus handler 
<img src=x onmouseover=alert(1)>

Script is stripped; img passes untouched — filter was written for the reported payload, not the whole spec.

Spoiler — Level 4: javascript: attribute values 
<iframe src=javascript:alert(1)></iframe>
<a href=javascript:alert(2)>click me</a>

Handlers rewritten, but the filter never looked at attribute values. javascript: inside src/href executes on load/navigate — the real-workhorse bypass from the lesson ("people focus on event handlers and forget there are other ways").