W7 half-encoded (attr)

Angle brackets are encoded, so no new tags...

...but quotes are not, and you are inside value="...". Break the attribute: " autofocus onfocus=alert(document.domain) x="

RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only