> For the complete documentation index, see [llms.txt](https://unsbotch.gitbook.io/unsbotch/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://unsbotch.gitbook.io/unsbotch/my-writeups/xssy/uppercase.md).
# UPPERCASE
UPPERCASE - great medium challenge with 5 solutions.
As always we will start testing the input entry points for simple XSS paylaod.
But we can see that our payload was convert to uppercase and event handler `onerror` was circumcised.
I have never use XSS payload in uppercase so because of that first thing i did, is to google "uppercase xss payloads".
I found a tweet from @BRuteLogic and tried to use him.
But as you can see we can't fully use this payload because of event handler filtering and i continued trying to bypass event handler filtering
I understood that the filter simply does not accept any events such as `onerror, onload, onmousemove` etc., and is triggered when something paired is used, for example RR.
But then i found intersting behavior of inputing event handler:
If we just start adding a lot of letters containing "onerror" we can continue our "RR" and it s accept pair letters and "ERROR" too. So we can just try to add more letters and look at behavior how is locate.
Delete not needed chars and get works payload : `OoNnEonerror`.
It still will not work, so doing the same with `onload` handler and check @BRuteLogic payload:
By the same operation we got: `oonONonlOAD` now let's check final payload and get XSS.
`