161–168 of 168 posts
Earlier quoted context omitted.
How is it doing that?
Using ... as a payload won't work because the browser won't execute scripts added after the page has loaded.
Earlier quoted context omitted.
What payload are you using on that level? Keep in mind that ";" is often treated as a parameter separator in URLs, similarly to &. If you put it into the mock URL bar it will terminate the value of your parameter (see also http://en.wikipedia.org/wiki/Query_string#Web_forms ) PS. Consider it reported, thanks!
Escaping the ';' works on that one
I had fun with this; definitely a good mini game to learn more about XSS, although it's a pitty that you can cheat-pass a level simply by appending '/record' to the end of the URL. (Granted it's just a game) I.e. https://xss-game.appspot.com/level1/record allows you to go straight onto level 2. Anywhoo, HackThisSite is similar & worth checking out (albeit it covers a wider range of web app security issues)
How can you solve level 2 ? I used next sentence, but, it don't work.
Any suggest ?
Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...
I used "//" to get around the http regex (but this requires using an https host as you mentioned), is there another way to get around the regex?
Earlier quoted context omitted.
Could you explain why the * works in there?
JS does automatic type conversion in this case, so it's syntactically correct to multiply a string with a number (or function result). We're just interested in the side-effects of alert(), so it doesn't really matter what kind of expression we use it in, as long as it parses correctly and causes alert() to be executed (evaluated).
Earlier quoted context omitted.
For me it actually worked to use a script tag, but I'm confused about why, as the hint says it shouldn't. This is the URL I used: https://xss-game.appspot.com/level3/frame#'> alert('bla') But the hint is hinting at something more like this, I think: https://xss-game.appspot.com/level3/frame#' onerror="alert('bla')"> Can somebody explain why the first one worked? Are they wrong when they say that the browser won't exe…
Why do we need the single quote after the # sign? I don't understand why and would like to know.
The real problem is the substring(1) function which passes the "num", instead of making sure the length is 1 it is allowing everything.