3 ms·
Yes, but if you try https://xss-game.appspot.com/level1/frame?query=<script>alert('hi');</script> it doesn't work. https://xss-game.appspot.com/level1/fr
by i336_ 10y ago
Yes, but if you try
https://xss-game.appspot.com/level1/frame?query=<script>alert('hi');</script>
it doesn't work.
https://xss-game.appspot.com/level1/frame?query=<script>alert('hi')</script>
without the semicolon does.
I realize it's JS, but I can see it's just dumbly parsing what I've typed as opposed to eg overloading alert() (which can be done: http://stackoverflow.com/questions/1729501/javascript-overriding-alert http://stackoverflow.com/questions/1729501/javascript-overri...) and demonstrating/using best practices in the source code to prevent the JS I type from actually damaging the demo itself.
For something that's really interesting, search Pinterest for "reactjs", and see if you get the "Hack Pinterest" tile as your first result. That was fun to play with!
- CGamesPlay 10y agoOpen your web inspector, set the console target to the iframe, and type "alert". Notice that the alert function is overridden. Set your URL to https://xss-game.appspot.com/level1/frame?query=a;b https://xss-game.appspot.com/level1/frame?query=a;b. Notice that the ";b" is removed from the results page. Challenge your initial assumption about the checker being stupidly naive. Notice XSS bugs in your own code afterwards.
- i336_ 10y agoThanks. I'll admit this is a field I'm completely unfamiliar with. (I was actually considering bug bounty hunting in the future, thanks for the wake up call.) I actually noticed the ; was being removed and am very confused as to why, but forgot to mention that in my earlier comment.
- CGamesPlay 10y agoFull disclosure: I didn't bother to learn about why the ; is being split. But I can hasten a guess: the python web server treats that as a parameter separator. ... and confirmed. [1] https://www.google.com/webhp?q=webapp.WSGIApplication+semicolon https://www.google.com/webhp?q=webapp.WSGIApplication+semico... [2] https://groups.google.com/forum/#!topic/google-appengine/Aai8ShndteA https://groups.google.com/forum/#!topic/google-appengine/Aai... [3] https://www.w3.org/TR/REC-html40/appendix/notes.html#h-B.2.2 https://www.w3.org/TR/REC-html40/appendix/notes.html#h-B.2.2
- i336_ 10y agoAh, I see. That makes perfect sense, thanks for explaining it :)