During our Red/Blue team practice my friend made a web forum application where people can post messages.

What he did was filtering:

  • The equal sign
  • The key words: "javascript", "alert", "url"
  • Some keywords that usually make html tags: "script" "img" "video" "iframe"
  • The word: "cookie"
  • The word: "eval"

The purpose of the game practice is for the red team to put a payload that steals users' cookies.

My friend made a mistake by making his own filter (not recommended in the real world). He forgot to filter the svg and the style tags.

For instance:


Can be seen in my request bin endpoint.

However I cannot seem to steal cookies because I am not able to use document.cookie because "cookie" is filtered. Plus the equal sign being filtered it becomes more difficult...

Some other red teams were able to bypass his filter, so there must be a payload that works...

What I tried so far:

  • UTF encodings with %3D and others => fail
  • Other html encoding &equals or &#equals; => fail
  • CoOkIe instead of cookie => fail

Any ideas will be much appreciated

  • 2
    Hint: <something>.<prop> lets you access some property from an object in JS. What are other ways to access properties?
    – Josiah
    Dec 14, 2022 at 23:47
  • 1
    Isn't this the entire reason why JSFsck was invented as a language? en.wikipedia.org/wiki/JSFuck
    – user120651
    Dec 16, 2022 at 18:37

2 Answers 2


If the server simply removes the string cookie, try something like this: <scookiecript></scookiecript>

When the word cookie gets removed, leaving you with <script></script>

If this works, you can combine this with your style import:

  • This is better. If you do not know details, instead of asking, you can simply state your assumptions as a conditional, as I have done when editing your question. Bear in mind that if your assumption is incorrect, then your answer won't be answering the question. So, it might be best to wait for the details before speculating.
    – schroeder
    Dec 18, 2022 at 14:03

One way is to use a different payload that does not rely on = sign or the word cookie. I would try to redirect the user to a different "non-friendly" site using window.location or window.open.

Another way is to "Snipe" the cookie (love this phrase) to extract the info that you need. I would use something like document.cookie.split(';') to split the cookie into an array of keys. If you loop them you will get the results that you need.

Another strategy that would extract the cookie would require an iframe element with src that serves the js file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .