mission · xss-reflected-sanitizer
Bypass the Sanitizer
HackerMart finally deployed a 'sanitizer'. It strips `<script>` and removes any `onerror=` attribute. Surely this time they're safe… unless you find the gap between what the filter removes and what the browser executes.
objective
Fire an alert box past a filter that strips `<script>` and `onerror`.
Simulated target for training. This page is the vulnerable website — payloads you craft execute here in your browser. Practice only on systems you own or are authorized to test.