Well the first levels are trivial, right click "inspect element" and adding a onClick="alert();" on a random button and tadaa. I'm not sure you can qualify this as XSS attack though, can you?
Google's XSS game
101–110 of 168 posts
Re: Google's XSS game
#102Loved it. Though got struck in Lvl4 and 6. But lvl4 was really a smart question.
Re: Google's XSS game
#103Fun! Level 6 failed to load any widgets, evil or otherwise, in Chrome; I had to switch to Firefox and redo the whole test. For my external script I used http://pastebin.com/raw.php?i=15S5qZs0 , although I don't think the lack of a .js extension there was the problem.
I hope this isn't a spoiler, but remember there are other ways to load resources without an external request. You can pass that stage without any requests to external servers.
Re: Google's XSS game
#104Well the first levels are trivial, right click "inspect element" and adding a onClick="alert();" on a random button and tadaa. I'm not sure you can qualify this as XSS attack though, can you?
You did it wrong.
Re: Google's XSS game
#105I probably should be too embarrassed to ask this question, but why can't I use script tags in the second test? I don't understand what's preventing me from doing that.
Re: Google's XSS game
#106I probably should be too embarrassed to ask this question, but why can't I use script tags in the second test? I don't understand what's preventing me from doing that.
The second question disallows the script tag.
Re: Google's XSS game
#107Re: Google's XSS game
#108Earlier quoted context omitted.
The hint for level 3 reads: As before, using ... as a payload won't work because the browser won't execute scripts added after the page has loaded. How do you solve level 3?
For me it actually worked to use a script tag, but I'm confused about why, as the hint says it shouldn't. This is the URL I used: https://xss-game.appspot.com/level3/frame#'> alert('bla') But the hint is hinting at something more like this, I think: https://xss-game.appspot.com/level3/frame#' onerror="alert('bla')"> Can somebody explain why the first one worked? Are they wrong when they say that the browser won't exe…
Might be because the script is injected during `onload`, which is arguably the very end of the page-loading process. But, yeah, the hint is clearly incorrect in the latest version of Chrome.
Re: Google's XSS game
#109Fun! Level 6 failed to load any widgets, evil or otherwise, in Chrome; I had to switch to Firefox and redo the whole test. For my external script I used http://pastebin.com/raw.php?i=15S5qZs0 , although I don't think the lack of a .js extension there was the problem.
I hope this isn't a spoiler, but remember there are other ways to load resources without an external request. You can pass that stage without any requests to external servers.
Care to spoil how? I used an external server (Dropbox), but I'd love to know how to do it without.
Re: Google's XSS game
#110Level 4 has a bug. Entering a string in the text box for the timer solves the problem, but putting that string directly as the get parameter in the URL doesn't. Anyone know how to report this?
Do you have a '+' in your string? In URL it's interpreted as a space, use '%2B' instead.