"There will be cake at the end of the test." That's what the computer said LAST time. But I'm still alive... ;)
Ahhh, that's what that was! http://snag.gy/43JI3.jpg
Spoiler alert!
Google's XSS game
131–140 of 168 posts
Re: Google's XSS game
#132So did anyone else cheat their way to the cake level?
Re: Google's XSS game
#133So, does the cake have a recruiting message encoded in it? :)
Re: Google's XSS game
#134Fun! Level 6 failed to load any widgets, evil or otherwise, in Chrome; I had to switch to Firefox and redo the whole test. For my external script I used http://pastebin.com/raw.php?i=15S5qZs0 , although I don't think the lack of a .js extension there was the problem.
got the same problem, it only works with a https address !
Nope. Works even if you use an address without http, but beginning with only "//"
Re: Google's XSS game
#135"There will be cake at the end of the test." That's what the computer said LAST time. But I'm still alive... ;)
Hehe I immediately spotted it too :p
Re: Google's XSS game
#136Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...
What's the trivial solution to this? I also wound up hosting the malicious file on my personal server...
I put a small gist up and hotlinked through githack.com
Re: Google's XSS game
#137Does anyone know how to submit corrections to Google? I've not been able to find a way after noticing a few mistakes on Google's XSS help page. There are a few examples using an image tag but the tags haven't been closed properly: https://www.google.com/about/appsecurity/learning/xss/index.... e.g. "Now, enter <img src='' onerror="alert(document.cookie);" and hit 'Share status!'."
Some of their products have bug trackers. That said, I submitted some fixes to their Android docs in the Android issue tracker years ago. Really obvious stuff like where their sample code would cause a crash due to trying to start a dialog with the wrong type of context, etc.. They never fixed them. So there is essentially no way. They apparently have a bug bounty system, but you would have to exploit their mistakes…
Thanks for at least attempting to contribute! If you'll point me towards the patches, or at least the bad docs, is be happy to help get them fixed.
Re: Google's XSS game
#138Level 4 has a bug. Entering a string in the text box for the timer solves the problem, but putting that string directly as the get parameter in the URL doesn't. Anyone know how to report this?
Thankyou. I was trying my payload but couldn't get it to work. I'm sure there's a better way to do it.
Re: Google's XSS game
#139Fun! Level 6 failed to load any widgets, evil or otherwise, in Chrome; I had to switch to Firefox and redo the whole test. For my external script I used http://pastebin.com/raw.php?i=15S5qZs0 , although I don't think the lack of a .js extension there was the problem.
The regex is case sensitive. That's how I solved it.
Re: Google's XSS game
#140can someone share theirs hosted script that echos and alert? :D
They provided a hosted callback in the clues. Just change foo to alert.
The callback in the hints didn't work for me in the game, but the other suggestions here are working and quite eye opening ...
That this works is really scary if not fully surprising: data:text/javascript;base64,YWxlcnQoMTMzNyk=
Thanks jehna1 , sebslomski , all!