> For the complete documentation index, see [llms.txt](https://unsbotch.gitbook.io/unsbotch/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://unsbotch.gitbook.io/unsbotch/my-writeups/xssy/unscripted.md). # Unscripted Unscripted - medium challenge with 5 solutions.

As always we checking entry points of input on basic XSS payload:

We can mark:\ 1\)our input is pasting to .innerHTML so thats mean we can trigger XSS 2\)open tag from \ was removed and maybe there is a filter and our goal to bypass it. After some attempts to confuse filter by adding a lot of "<" symbols, encode to url, html and etc. it was not successful, i tried to escape from: `document.getElementById("div").innerHTML="``img src=x onerror=alert()>``"` By adding additional quotes and look at result:

Great! thats work, now we can just return alert;

After paste this payload in browser alert doesn't return we can check devtools:

We notice an error in `