What is lvl2's answer? I'm trying:
just onerror="alert(1)" :)
I did
click
Google's XSS game
51–60 of 168 posts
Re: Google's XSS game
#52Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought! Checking our stuff for this mistake now ...
I used "//" to get around the http regex (but this requires using an https host as you mentioned), is there another way to get around the regex?
data:,alert('hi')
Re: Google's XSS game
#53Earlier quoted context omitted.
The hint for level 3 reads: As before, using ... as a payload won't work because the browser won't execute scripts added after the page has loaded. How do you solve level 3?
For me it actually worked to use a script tag, but I'm confused about why, as the hint says it shouldn't. This is the URL I used: https://xss-game.appspot.com/level3/frame#'> alert('bla') But the hint is hinting at something more like this, I think: https://xss-game.appspot.com/level3/frame#' onerror="alert('bla')"> Can somebody explain why the first one worked? Are they wrong when they say that the browser won't exe…
Why do we need the single quote after the # sign? I don't understand why and would like to know.
Re: Google's XSS game
#54Finally, cake.
Re: Google's XSS game
#55I had fun with this; definitely a good mini game to learn more about XSS, although it's a pitty that you can cheat-pass a level simply by appending '/record' to the end of the URL. (Granted it's just a game)
I.e. https://xss-game.appspot.com/level1/record allows you to go straight onto level 2.
Anywhoo, HackThisSite is similar & worth checking out (albeit it covers a wider range of web app security issues)
Re: Google's XSS game
#56For anyone who has never done XSS attacks before, you may find these learning resources helpful.
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_She...
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_P...
Re: Google's XSS game
#57I asked this question once on SO and never really got a "great" answer I was after. If my site will only ever allow users to see their own submitted data, and never ever data another user has submitted (i.e. no general 'posts' etc) - then is there actually a XSS risk on my site? So I'm curious if an attacker can gain anything by looking at their own XSS attack? http://stackoverflow.com/q/10265624/1317935
I think the real answer to this one is not really. Most of the possible attacks are either unrealistic or only possible if you're doing something stupid to begin with.
That said, there is still no excuse to trust user input. Always protect against XSS like you always protect against SQL injection.
Re: Google's XSS game
#58Does anyone know how to submit corrections to Google? I've not been able to find a way after noticing a few mistakes on Google's XSS help page. There are a few examples using an image tag but the tags haven't been closed properly:
https://www.google.com/about/appsecurity/learning/xss/index....
e.g. "Now, enter <img src='' onerror="alert(document.cookie);" and hit 'Share status!'."
Re: Google's XSS game
#59Re: Google's XSS game
#60How do you solve lv4?
' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.
I can't figure how to close the quote after the '99 ? I realise that specifying ' on URL gets encoded to %27 but not sure how to turn that into the closing ' for startTime('99'); .....
Help!