4 ms·
Open your web inspector, set the console target to the iframe, and type "alert". Notice that the alert function is overridden. Set your URL to https://xss-game
by CGamesPlay 10y ago
Open your web inspector, set the console target to the iframe, and type "alert". Notice that the alert function is overridden.
Set your URL to https://xss-game.appspot.com/level1/frame?query=a;b https://xss-game.appspot.com/level1/frame?query=a;b. Notice that the ";b" is removed from the results page.
Challenge your initial assumption about the checker being stupidly naive. Notice XSS bugs in your own code afterwards.
- i336_ 10y agoThanks. I'll admit this is a field I'm completely unfamiliar with. (I was actually considering bug bounty hunting in the future, thanks for the wake up call.) I actually noticed the ; was being removed and am very confused as to why, but forgot to mention that in my earlier comment.
- CGamesPlay 10y agoFull disclosure: I didn't bother to learn about why the ; is being split. But I can hasten a guess: the python web server treats that as a parameter separator. ... and confirmed. [1] https://www.google.com/webhp?q=webapp.WSGIApplication+semicolon https://www.google.com/webhp?q=webapp.WSGIApplication+semico... [2] https://groups.google.com/forum/#!topic/google-appengine/Aai8ShndteA https://groups.google.com/forum/#!topic/google-appengine/Aai... [3] https://www.w3.org/TR/REC-html40/appendix/notes.html#h-B.2.2 https://www.w3.org/TR/REC-html40/appendix/notes.html#h-B.2.2
- i336_ 10y agoAh, I see. That makes perfect sense, thanks for explaining it :)