Hard
Cross-Site Scripting
Lumen Realty DOM XSS filter bypass
A real-estate listing search. A client-side filter strips one exact tag, case-sensitively, and nothing else.
PentestingHere Academy
Official Academy lab
- Attempts
- 5
- Solves
- 3
- Published
- 25 Aug 2026
Scenario
Lumen Realty's listing search reads a query from location.hash and writes "Showing results for: ..." via innerHTML, after stripping the literal string onerror from the input. It's entirely in the browser; nothing reaches the server.
Goal
Get JavaScript to execute via the URL fragment despite the filter. Your search is delivered to an agent who re-opens it in their own browser; any alert(), confirm() or prompt() that fires there sends the flag straight to the banner on your page.