Webverselabs Kismet Challenge XSS

Scenario :

Kismet is a small-town matchmaking service that still sends real letters. The online bio editor allows a short whitelist of tags for formatting — including details, for collapsible sections. The dev knew about markdown. He didn’t know about ontoggle.

Solution :

As usual we first need to browse the application just like a normal user, check different endpoints, different requests made to the server then try and find an injectable spot.

/Members :

This is just a static web page that returns a list of members , pretty useless for us .

/Letter Guide :

Again just a manual showing us how to write a letter on the app, just a static web page.

/Weekly Matches :

Another static page showing us different matches for the week .

/Letter Editor :

Finally somewhere we can inject :)

Now it’s already showing us which Formats are allowed :

<b>
<i>
<u>
<em>
<strong>
<details>

If we try to inject a simple XSS Payload using the script tag for example , this shouldn’t work since it is filtered based on what’s written :

We see that the script tag are removed automatically .

Now since we have the details tag available , we can check if there is a way we can use it for an XSS :

https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#noembed-consuming-tag

Here we can view all the tags that can allow the injection of JS code .

The details tag supports event handlers like ontoggle that can be used to execute JavaScript.

We can test these payloads :

Now if we inject it :

Perfect this works , now all we have to do is click on the Details section to trigger the JS execution .

From there once the payload is executed and the XSS is triggered we will get our flag :

That was all for this challenge. See you in the next one .