DOJO CHALLENGE #20 Winners!

This write-up documents a DOM-based XSS (CWE-79) in the 'Butters Adventure' challenge where user-controlled $cmd output is written with innerHTML. The author demonstrates bypassing blacklisted characters by encoding payloads with octal escape sequences, provides a proof-of-concept that changes an in-page object property (making the player 'offline'), and recommends input validation, improved filtering, and Content Security Policy as mitigations.