4 ms·

Do you... realize it's actually a live webpage your testing on? It's not like the server checks to see if you wrote exactly the right answer. It just checks to

by yathern 10y ago

Do you... realize it's actually a live webpage your testing on? It's not like the server checks to see if you wrote exactly the right answer. It just checks to see if an alert is fired. If it didn't work, it's because you didn't do it right. <script>alert()</script> most certainly works unless you have noscript.

i336_ 10y ago
Yes, but if you try https://xss-game.appspot.com/level1/frame?query=<script>alert('hi');</script> it doesn't work. https://xss-game.appspot.com/level1/frame?query=<script>alert('hi')</script> without the semicolon does. I realize it's JS, but I can see it's just dumbly parsing what I've typed as opposed to eg overloading alert() (which can be done: http://stackoverflow.com/questions/1729501/javascript-overriding-alert http://stackoverflow.com/questions/1729501/javascript-overri...) and demonstrating/using best practices in the source code to prevent the JS I type from actually damaging the demo itself. For something that's really interesting, search Pinterest for "reactjs", and see if you get the "Hack Pinterest" tile as your first result. That was fun to play with!
- CGamesPlay 10y ago
  Open your web inspector, set the console target to the iframe, and type "alert". Notice that the alert function is overridden. Set your URL to https://xss-game.appspot.com/level1/frame?query=a;b https://xss-game.appspot.com/level1/frame?query=a;b. Notice that the ";b" is removed from the results page. Challenge your initial assumption about the checker being stupidly naive. Notice XSS bugs in your own code afterwards.
  - i336_ 10y ago
    Thanks. I'll admit this is a field I'm completely unfamiliar with. (I was actually considering bug bounty hunting in the future, thanks for the wake up call.) I actually noticed the ; was being removed and am very confused as to why, but forgot to mention that in my earlier comment.
    - CGamesPlay 10y ago
      Full disclosure: I didn't bother to learn about why the ; is being split. But I can hasten a guess: the python web server treats that as a parameter separator. ... and confirmed. [1] https://www.google.com/webhp?q=webapp.WSGIApplication+semicolon https://www.google.com/webhp?q=webapp.WSGIApplication+semico... [2] https://groups.google.com/forum/#!topic/google-appengine/Aai8ShndteA https://groups.google.com/forum/#!topic/google-appengine/Aai... [3] https://www.w3.org/TR/REC-html40/appendix/notes.html#h-B.2.2 https://www.w3.org/TR/REC-html40/appendix/notes.html#h-B.2.2
      - i336_ 10y ago
        Ah, I see. That makes perfect sense, thanks for explaining it :)

by yathern 10y ago

i336_ 10y ago

Yes, but if you try https://xss-game.appspot.com/level1/frame?query=<script>alert('hi');</script> it doesn't work. https://xss-game.appspot.com/level1/frame?query=<script>alert('hi')</script> without the semicolon does. I realize it's JS, but I can see it's just dumbly parsing what I've typed as opposed to eg overloading alert() (which can be done: http://stackoverflow.com/questions/1729501/javascript-overriding-alert http://stackoverflow.com/questions/1729501/javascript-overri...) and demonstrating/using best practices in the source code to prevent the JS I type from actually damaging the demo itself. For something that's really interesting, search Pinterest for "reactjs", and see if you get the "Hack Pinterest" tile as your first result. That was fun to play with!

CGamesPlay 10y ago
Open your web inspector, set the console target to the iframe, and type "alert". Notice that the alert function is overridden. Set your URL to https://xss-game.appspot.com/level1/frame?query=a;b https://xss-game.appspot.com/level1/frame?query=a;b. Notice that the ";b" is removed from the results page. Challenge your initial assumption about the checker being stupidly naive. Notice XSS bugs in your own code afterwards.
- i336_ 10y ago
  Thanks. I'll admit this is a field I'm completely unfamiliar with. (I was actually considering bug bounty hunting in the future, thanks for the wake up call.) I actually noticed the ; was being removed and am very confused as to why, but forgot to mention that in my earlier comment.
  - CGamesPlay 10y ago
    Full disclosure: I didn't bother to learn about why the ; is being split. But I can hasten a guess: the python web server treats that as a parameter separator. ... and confirmed. [1] https://www.google.com/webhp?q=webapp.WSGIApplication+semicolon https://www.google.com/webhp?q=webapp.WSGIApplication+semico... [2] https://groups.google.com/forum/#!topic/google-appengine/Aai8ShndteA https://groups.google.com/forum/#!topic/google-appengine/Aai... [3] https://www.w3.org/TR/REC-html40/appendix/notes.html#h-B.2.2 https://www.w3.org/TR/REC-html40/appendix/notes.html#h-B.2.2
    - i336_ 10y ago
      Ah, I see. That makes perfect sense, thanks for explaining it :)