151–160 of 168 posts
Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...
What's the trivial solution to this? I also wound up hosting the malicious file on my personal server...
(unless I was doing it wrong)
Fun! Level 6 failed to load any widgets, evil or otherwise, in Chrome; I had to switch to Firefox and redo the whole test. For my external script I used http://pastebin.com/raw.php?i=15S5qZs0 , although I don't think the lack of a .js extension there was the problem.
The regex is case sensitive. That's how I solved it.
[0] http://www.paulirish.com/2010/the-protocol-relative-url/
This should really direct to the http instead of https version to avoid the mixed content error for problem 6.
Someone solved the level 6?
SPOILER: I used the " html += ""; " untrusted injection, but after reading the hints it seems to be suggesting window.location and the postmessage to parent stuff.
Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...