# PixelSearch — Reflected XSS (filter bypass) (CTF challenge)

> PixelSearch reflects your search term back into the page. The developers 'fixed' XSS by stripping tags — but that's not the only way to run JavaScript.

Canonical: https://codelivly.com/ctf/challenges/pixelsearch-xss

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Medium |
| Points | 300 |
| Estimated time | 20 min |
| Type | Live instance |
| Solves | 36 |
| Author | Codelivly |

PixelSearch reflects your search term back into the page. The developers 'fixed' XSS by stripping  tags — but that's not the only way to run JavaScript. Craft a payload that survives the filter and would execute; the site's own XSS scanner will confirm the sink and release the flag. (Your payload is validated server-side and shown escaped — you prove the exploit, the app never runs it.)

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)