4 ms·

Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more tr

• yen223 12y ago
  What's the trivial solution to this? I also wound up hosting the malicious file on my personal server...
  • deleted 12y ago
    [deleted]
  • trias 12y ago
    data-uris also work: #data:text/javascript,alert('pwn')
    • aidos 12y ago
      That's what I used too. Hosting scripts is far too much like hard work...
  • hrrsn 12y ago
    There are apparently easier ways, but I just chucked an alert(); in my Dropbox public folder, did an //dl.dropboxusercontent.com/u/14XXX/xss.js as they serve both http and https.
  • deleted 12y ago
    [deleted]
  • joshschreuder 12y ago
    I put a small gist up and hotlinked through githack.com
  • deleted 12y ago
    [deleted]
• gibybo 12y ago
  I used "//" to get around the http regex (but this requires using an https host as you mentioned), is there another way to get around the regex?
  • yen223 12y ago
    Spoiler: RaNDoM cApS
  • jonaspf 12y ago
    Use upper-case characters
    • deleted 12y ago
      [deleted]
  • vsakos 12y ago
    i think ftp:// works too EDIT: no, it doesn't :D
  • tautvidas 12y ago
    Adding a space just before the URL works just as well.
  • _august 12y ago
    //www.google.com/jsapi?callback=alert
  • gpvos 12y ago
    data:,alert('hi')
  • deleted 12y ago
    [deleted]
• barrydahlberg 12y ago
  SPOILER: You need a way to defeat the regex (see other comments here). Then think about what the "foo" actually does (and read the error console).
• smsm42 12y ago
  gist.github.com serves https, so you can use it whenever you need something sent over https.