Fictional Application
SanitizePro Markdown & Preview
Collaborative Documentation & Rich Notes
SanitizePro provides a live text and note preview engine. To protect against DOM XSS, the developer wrote a custom client-side sanitization function in `preview-sanitizer.js` that strips `<script>` tags and `javascript:` strings using regex replace. Audit the regex logic to discover its bypass.
🎯 Assessment Objective
Inspect the client-side regex filter, craft a payload that circumvents the replacement rules, and trigger XSS.
Educational Guidance: Treat this lab like an authorized penetration test. Analyze user-controlled parameters, review browser source code and developer tools, and discover how input is handled.