Google's XSS game • Hacker News Board

Re: Google's XSS game

#71

Post by mavfly » Thu, May 29, 2014, 2:02 PM UTC

Someone solved the level 6?

Re: Google's XSS game

#72

Post by sourthyme » Thu, May 29, 2014, 2:06 PM UTC

namanaggarwal wrote: post #62

lazyjones wrote: post #12

Earlier quoted context omitted.

' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.

still not able to get :-(

Use the text input instead of the url.

Re: Google's XSS game

#73

Post by neil_s » Thu, May 29, 2014, 2:17 PM UTC

Level 4 has a bug. Entering a string in the text box for the timer solves the problem, but putting that string directly as the get parameter in the URL doesn't. Anyone know how to report this?

Re: Google's XSS game

#74

Post by rhubarbcustard » Thu, May 29, 2014, 2:24 PM UTC

lazyjones wrote: post #68

aetch wrote: post #61

Earlier quoted context omitted.

Can you elaborate on this? I tried that and got "unexpected identifier" as a console error. Not sure how it works.

SPOILER ALERT I used this: 1'* alert()* ' (without the spaces needed for markdown here)

Could you explain why the * works in there?

Re: Google's XSS game

#75

Post by lnanek2 » Thu, May 29, 2014, 2:28 PM UTC

michaelx386 wrote: post #58

Does anyone know how to submit corrections to Google? I've not been able to find a way after noticing a few mistakes on Google's XSS help page. There are a few examples using an image tag but the tags haven't been closed properly: https://www.google.com/about/appsecurity/learning/xss/index.... e.g. "Now, enter <img src='' onerror="alert(document.cookie);" and hit 'Share status!'."

Some of their products have bug trackers. That said, I submitted some fixes to their Android docs in the Android issue tracker years ago. Really obvious stuff like where their sample code would cause a crash due to trying to start a dialog with the wrong type of context, etc.. They never fixed them. So there is essentially no way. They apparently have a bug bounty system, but you would have to exploit their mistakes to do injection or something before the mistake would qualify.

Re: Google's XSS game

#76

Post by octatone2 » Thu, May 29, 2014, 2:34 PM UTC

stevekemp wrote: post #66

instakill wrote: post #47

What is lvl2's answer? I'm trying:

My solution was: Interesting to see so many people used onError instead.

img src='garbage' onerror='script' is gauranteed to auto execute, where mouseover requires the user to mouse over the element.

Re: Google's XSS game

#77

Post by octatone2 » Thu, May 29, 2014, 2:36 PM UTC

0x4139 wrote: post #20

can someone share theirs hosted script that echos and alert? :D

They provided a hosted callback in the clues. Just change foo to alert.

Re: Google's XSS game

#78

Post by jevin » Thu, May 29, 2014, 2:39 PM UTC

This is great! XSS is one of the hardest things to get right when it comes to security. I'll be sure to complete all the challenges, because I'm working on a product that could use some good HTML sanitizing.

Re: Google's XSS game

#79

Post by heri0n » Thu, May 29, 2014, 2:42 PM UTC

on level 5 i tried to modify the url, but my quotes are automatically encoded, also tried encoding it using %22.. but didn't work.. I'm using chrome on osx, could it be a browser thing, i managed to get it to work by manually modifying the html using the developer tools :p

Re: Google's XSS game

#80

Post by [deleted] » Thu, May 29, 2014, 2:46 PM UTC

yen223 wrote: post #15

lazyjones wrote: post #10

Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...

What's the trivial solution to this? I also wound up hosting the malicious file on my personal server...

[deleted]