Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's XSS game

xss-game.appspot.com

Post reply on HN
Print view View original

61–70 of 168 posts

Re: Google's XSS game

#61

Post by aetch »

lazyjones wrote: post #12
johnadam wrote: post #11

How do you solve lv4?

' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.

Can you elaborate on this? I tried that and got "unexpected identifier" as a console error. Not sure how it works.

Re: Google's XSS game

#62

Post by namanaggarwal »

lazyjones wrote: post #12
johnadam wrote: post #11

How do you solve lv4?

' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.

still not able to get :-(

Re: Google's XSS game

#63

Post by nmjenkins »

laurencei wrote: post #35

I asked this question once on SO and never really got a "great" answer I was after. If my site will only ever allow users to see their own submitted data, and never ever data another user has submitted (i.e. no general 'posts' etc) - then is there actually a XSS risk on my site? So I'm curious if an attacker can gain anything by looking at their own XSS attack? http://stackoverflow.com/q/10265624/1317935

Do you have CSRF protection on login? If not, an attacker can add an XSS attack to their own account, then log the victim into the attacker's account by submitting a cross-site post request with their username and password. This could potentially then read data from any other accounts the victim is logged in to at the same time. If you don't support multiple simultaneous logins, it could still allow the attacker to generate a phishing page, at your URL, which sent them back any data the user entered.

Re: Google's XSS game

#64

Post by codeman123 »

namanaggarwal wrote: post #62
lazyjones wrote: post #12

Earlier quoted context omitted.

' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.

still not able to get :-(

can't solve it either :-/

Re: Google's XSS game

#67

Post by tautvidas »

aetch wrote: post #61
lazyjones wrote: post #12

Earlier quoted context omitted.

' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.

Can you elaborate on this? I tried that and got "unexpected identifier" as a console error. Not sure how it works.

The point is to break out of the startTimer() function call, e.g.:

    startTimer('');foo();//');
The remaining '); can be commented out in order to not create any syntax errors.

Re: Google's XSS game

#68

Post by lazyjones »

aetch wrote: post #61
lazyjones wrote: post #12

Earlier quoted context omitted.

' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.

Can you elaborate on this? I tried that and got "unexpected identifier" as a console error. Not sure how it works.

SPOILER ALERT

I used this: 1'* alert()* '

(without the spaces needed for markdown here)

Post reply on HN