DOJO CHALLENGE #15 Winners!

This write-up documents a successful Web Application Firewall (WAF) bypass and DOM-based XSS exploit in a challenge environment: the author analyzes the WAF filtering rules, iteratively constructs an encoded payload to break out of an img alt attribute, and uses encoding/alternate syntax (URL-encoding, backticks, hex/unicode escapes) to set an application variable to "Admin" and trigger an alert. The report includes source context, step-by-step reasoning, and the final payload used to achieve arbitrary JavaScript execution.