3 ms·
The hint for level 3 reads: As before, using <script> ... as a payload won't work because the browser won't execute scripts added after the page has loa
by gabemart 12y ago
The hint for level 3 reads:
As before, using <script> ... as a payload won't work
because the browser won't execute scripts added after the
page has loaded.
How do you solve level 3?
- vsakos 12y agotry '>
- gabemart 12y agoEugh, I'm blind. Thanks!
- borski 12y agoSimilar to level 2 - just be careful about escaping out of the image src, and making sure the rest of the line is invalidated. Think about how you would do it if you were writing JS on your own...
- jannes 12y agoFor me it actually worked to use a script tag, but I'm confused about why, as the hint says it shouldn't. This is the URL I used: https://xss-game.appspot.com/level3/frame#'><script>alert('bla')</script> But the hint is hinting at something more like this, I think: https://xss-game.appspot.com/level3/frame#' onerror="alert('bla')"> Can somebody explain why the first one worked? Are they wrong when they say that the browser won't execute scripts added after the page has loaded?
- maxjus 12y agoInterestingly, modern WebKit browsers include an "XSS auditor" that will refuse to run javascript sent in the request that loaded the page. It's pretty good (and open-source), so figuring out a way to have XSS without hitting the auditor is a big win for the attacker.
- aetch 12y agoWhy do we need the single quote after the # sign? I don't understand why and would like to know.
- sbd 12y agoin the chooseTab function you have the following line: html += "<img src='/static/level3/cloud" + num + ".jpg' />"; the src opens with a single quote and looks for the 'num' var. So instead of num in the URL, you close the single quote and then close the image tag, and then run your script.
- HackyGeeky 12y agoAs "sbd" said, the "html +=" statement is using the "num" parameter as it is. The real problem is the substring(1) function which passes the "num", instead of making sure the length is 1 it is allowing everything.
- matchu 12y agoMight be because the script is injected during `onload`, which is arguably the very end of the page-loading process. But, yeah, the hint is clearly incorrect in the latest version of Chrome.