Google's XSS game • Hacker News Board

habosa wrote: post #109

fred_durst wrote: post #103

Earlier quoted context omitted.

I hope this isn't a spoiler, but remember there are other ways to load resources without an external request. You can pass that stage without any requests to external servers.

Care to spoil how? I used an external server (Dropbox), but I'd love to know how to do it without.

SpoilersrandomletterssdataurlSpoilermorerandemletters

Re: Google's XSS game

#124

Post by Toadsoup » Thu, May 29, 2014, 7:19 PM UTC

stevekemp wrote: post #66

instakill wrote: post #47

What is lvl2's answer? I'm trying:

My solution was: Interesting to see so many people used onError instead.

One of the hints says you can use onError()

I'm sure that's where most people are getting it from.

Re: Google's XSS game

#125

Post by thekos » Thu, May 29, 2014, 7:23 PM UTC

hhaidar wrote: post #119

* MORE SPOILERS! * #6 looks like: https://xss-game.appspot.com/level6/frame#//rawgit.com/hhaid...

This works also, and doesn't require a hosted file: https://xss-game.appspot.com/level6/frame#data:text/plain,al...

Re: Google's XSS game

#126

Post by mpetrov » Thu, May 29, 2014, 8:02 PM UTC

hhaidar wrote: post #119

* MORE SPOILERS! * #6 looks like: https://xss-game.appspot.com/level6/frame#//rawgit.com/hhaid...

Also just putting a space in front of https:// works, the script tag handles the leading space just fine.

Re: Google's XSS game

#127

Post by dvirsky » Thu, May 29, 2014, 8:05 PM UTC

mpetrov wrote: post #126

hhaidar wrote: post #119

* MORE SPOILERS! * #6 looks like: https://xss-game.appspot.com/level6/frame#//rawgit.com/hhaid...

Also just putting a space in front of https:// works, the script tag handles the leading space just fine.