How do you solve lv4?
Google's XSS game
11–20 of 168 posts
Re: Google's XSS game
#12How do you solve lv4?
' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.
Re: Google's XSS game
#13How do you solve lv4?
add your alert to the img onload
Re: Google's XSS game
#14I'm only trying to solve it for the cake.
Re: Google's XSS game
#15Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...
What's the trivial solution to this? I also wound up hosting the malicious file on my personal server...
Re: Google's XSS game
#16Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...
What's the trivial solution to this? I also wound up hosting the malicious file on my personal server...
[deleted]
Re: Google's XSS game
#17Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...
I used "//" to get around the http regex (but this requires using an https host as you mentioned), is there another way to get around the regex?
Re: Google's XSS game
#18Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...
I used "//" to get around the http regex (but this requires using an https host as you mentioned), is there another way to get around the regex?
Spoiler: RaNDoM cApS
Re: Google's XSS game
#19Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...
I used "//" to get around the http regex (but this requires using an https host as you mentioned), is there another way to get around the regex?
Use upper-case characters
Re: Google's XSS game
#20can someone share theirs hosted script that echos and alert? :D