Earlier quoted context omitted.
The second question disallows the script tag.
How is it doing that?
Using ... as a payload won't work because the browser won't execute scripts added after the page has loaded.
Google's XSS game
111–120 of 168 posts
Re: Google's XSS game
#112Re: Google's XSS game
#113I completed the game, but I honestly don't know: why wouldn't inject a script tag directly in level 2 work?
Because you can't have tags inside of textarea. All data inside of textarea is interpreted as text.
Re: Google's XSS game
#114Re: Google's XSS game
#115Earlier quoted context omitted.
The second question disallows the script tag.
How is it doing that?
Re: Google's XSS game
#116Does anyone know how to submit corrections to Google? I've not been able to find a way after noticing a few mistakes on Google's XSS help page. There are a few examples using an image tag but the tags haven't been closed properly: https://www.google.com/about/appsecurity/learning/xss/index.... e.g. "Now, enter <img src='' onerror="alert(document.cookie);" and hit 'Share status!'."
Hey, thanks - it's a valid concern, though an important point (which isn't really well explained in the document) is that this payload will work even if the tag isn't properly terminated. One of the reasons for using such broken payloads is to demonstrate that browsers will happily parse broken markup and that approaches such as removing " " won't be effective as a technique to prevent XSS (because such a regexp won'…
Thank you for this explanation. It makes sense to me now as before I would have expected the "" approach to make it safe. It's a shame browsers are so resilient :)
Re: Google's XSS game
#117How to solve level 5? :(((
I tried a lot with onClick and different js scripts on querry parameter... nothin' :(((
Re: Google's XSS game
#118* SPOILERS *
For #5 you can just do javascript:alert()
Re: Google's XSS game
#119* MORE SPOILERS! *
#6 looks like: https://xss-game.appspot.com/level6/frame#//rawgit.com/hhaid...
Re: Google's XSS game
#120Google has another game for learning webapp exploits and defenses here: https://google-gruyere.appspot.com/
I tried it a while back and enjoyed it quite a bit. I forget if I completely finished it or not, but it was educational.