I'm trying to solve @kinugawamasato xss challenge


It's a php script that receives a argument, escapes it and create he following tag on the html:

<script src="/xss_2020-06/check_code.php?callback=callback&amp;code=PARAM"></script>

So PARAM is the argument. The maximum payload is 10 chars

1 Answer 1


This is not a platform to solve CTF excercises. Still I had a look and will give you a hint:

When requesting check_code.php?callback=callback&code=PARAM you pass two arguments.

Your result is callback("Invalid code: 'PARAM'"). Don't focus too much on the code parameter.

It's a very easy CTF task

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .