4 ms·
This quickly turned from a lightsaber battle into an XSS battle. Negotiations were short.
by franky47 2y ago
This quickly turned from a lightsaber battle into an XSS battle. Negotiations were short.
- jeanmayer 2y agoThat was fun
- 082349872349872 2y agoTo avoid XSS, try physical lightsabers: https://www.youtube.com/watch?v=NyLSZee1uN8&t=202s https://www.youtube.com/watch?v=NyLSZee1uN8&t=202s
- franky47 2y agoI've been part of a dueling club before the pandemic, it was a very fun way of keeping in shape.
- deleted 2y ago[deleted]
- FranchuFranchu 2y agoI wrote an XSS worm that turns people's names into "yay" (and the worm code) but made myself immune to it. Now someone will have to figure out how to write a counter-worm to remove the worm from the lightsaber population. Until then, the "name" feature will be permanently held hostage (by the yay worm)
- jeanmayer 2y agoOk, you took it to the next level. This is amazing
- FranchuFranchu 2y agoYou might find this interesting, if you didn't know about it already: https://en.wikipedia.org/wiki/Samy_(computer_worm) https://en.wikipedia.org/wiki/Samy_(computer_worm) . In 2005 someone wrote an XSS worm in MySpace that made everyone follow a single person. It worked by injecting itself in the victim's profile description. It quickly reached more than a million people.
- yunruse 2y agoToying with #name-input and setName() was quite fun; I wish I was there to see this part happen! What `onerror` did you end up using to make it recursive?
- FranchuFranchu 2y agoThis was the injected JS code: document.getElementById('name-input').value = document.getElementById('yay').outerHTML; setName(); console.log('yay') The `<img>` tag I used was wrapped around a `div` element that had the `yay` id. I used `onload` instead of `onerror`, with an image link from Wikipedia.