This lab has a simple reflected XSS vulnerability. The site is blocking common tags but misses some SVG tags and events.
To solve the lab, perform a attack that calls the alert() function.
After accessing the lab, I initially tried to inject some HTML tags with scripts to test for XSS, but I encountered this error:
To determine if all tags were blocked, I sent the request to Burp Suite Intruder and added a payload marker around the tag. I then pasted a list of all tags from the XSS cheat sheet into the payload settings in the Payloads tab and launched the attack.
After launching the attack, I found out that image, text, svg, and animatetransform tags were allowed. I went back to the cheat sheet and found that svg and animatetransform could be used together to build a payload. To get the right event handler with them, I needed to brute-force that as well using Intruder. So I set up this request, copied the list of events from the cheat sheet, and launched the attack:
After launching the attack, I saw that the onbegin event was allowed, so I built this final payload:
After injecting that payload, I got an alert box, which solved the lab.