Google's XSS game • Hacker News Board

Re: Google's XSS game

#21

Post by octatone2 » Thu, May 29, 2014, 11:23 AM UTC

That was super fun!

Re: Google's XSS game

#22

Post by barrydahlberg » Thu, May 29, 2014, 11:25 AM UTC

lazyjones wrote: post #10

Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...

SPOILER: You need a way to defeat the regex (see other comments here). Then think about what the "foo" actually does (and read the error console).

Re: Google's XSS game

#23

Post by [deleted] » Thu, May 29, 2014, 11:26 AM UTC

lazyjones wrote: post #12

johnadam wrote: post #11

How do you solve lv4?

' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.

[deleted]

Re: Google's XSS game

#24

Post by vsakos » Thu, May 29, 2014, 11:26 AM UTC

gibybo wrote: post #17

lazyjones wrote: post #10

Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...

I used "//" to get around the http regex (but this requires using an https host as you mentioned), is there another way to get around the regex?

i think ftp:// works too

EDIT: no, it doesn't :D

Re: Google's XSS game

#25

Post by trias » Thu, May 29, 2014, 11:28 AM UTC

yen223 wrote: post #15

lazyjones wrote: post #10

Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...

What's the trivial solution to this? I also wound up hosting the malicious file on my personal server...

data-uris also work: #data:text/javascript,alert('pwn')

Re: Google's XSS game

#26

Post by jonaspf » Thu, May 29, 2014, 11:30 AM UTC

0x4139 wrote: post #20

can someone share theirs hosted script that echos and alert? :D

https://rawgit.com/JonasPf/7bf2f1628aad57dbde56/raw/79910b56...

Re: Google's XSS game

#27

Post by [deleted] » Thu, May 29, 2014, 11:43 AM UTC

lazyjones wrote: post #12

johnadam wrote: post #11

How do you solve lv4?

' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.

[deleted]

Re: Google's XSS game

#28

Post by [deleted] » Thu, May 29, 2014, 11:44 AM UTC

jonaspf wrote: post #19

gibybo wrote: post #17

Earlier quoted context omitted.

I used "//" to get around the http regex (but this requires using an https host as you mentioned), is there another way to get around the regex?

Use upper-case characters

[deleted]

Re: Google's XSS game

#29

Post by tautvidas » Thu, May 29, 2014, 11:45 AM UTC

gibybo wrote: post #17

lazyjones wrote: post #10

Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...

I used "//" to get around the http regex (but this requires using an https host as you mentioned), is there another way to get around the regex?

Adding a space just before the URL works just as well.

Re: Google's XSS game

#30

Post by krizan » Thu, May 29, 2014, 11:47 AM UTC

0x4139 wrote: post #20

can someone share theirs hosted script that echos and alert? :D

//dl.dropboxusercontent.com/u/18177522/google_xss_game/alert.js