Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's XSS game

xss-game.appspot.com

Post reply on HN
Print view View original

81–90 of 168 posts

Re: Google's XSS game

#81

Post by xss-game-bot »

neil_s wrote: post #73

Level 4 has a bug. Entering a string in the text box for the timer solves the problem, but putting that string directly as the get parameter in the URL doesn't. Anyone know how to report this?

What payload are you using on that level? Keep in mind that ";" is often treated as a parameter separator in URLs, similarly to &. If you put it into the mock URL bar it will terminate the value of your parameter (see also http://en.wikipedia.org/wiki/Query_string#Web_forms)

PS. Consider it reported, thanks!

Re: Google's XSS game

#83

Post by voxtex »

namanaggarwal wrote: post #62
lazyjones wrote: post #12

Earlier quoted context omitted.

' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.

still not able to get :-(

' + alert() + '

worked for me.

Re: Google's XSS game

#84

Post by xss-game-bot »

michaelx386 wrote: post #58

Does anyone know how to submit corrections to Google? I've not been able to find a way after noticing a few mistakes on Google's XSS help page. There are a few examples using an image tag but the tags haven't been closed properly: https://www.google.com/about/appsecurity/learning/xss/index.... e.g. "Now, enter <img src='' onerror="alert(document.cookie);" and hit 'Share status!'."

Hey, thanks - it's a valid concern, though an important point (which isn't really well explained in the document) is that this payload will work even if the tag isn't properly terminated.

One of the reasons for using such broken payloads is to demonstrate that browsers will happily parse broken markup and that approaches such as removing "" won't be effective as a technique to prevent XSS (because such a regexp won't match an unterminated tag like the example you pointed out).

Still, it could at least use a better explanation. The documentation fairy will take a look!

Re: Google's XSS game

#85

Post by lazyjones »

rhubarbcustard wrote: post #74
lazyjones wrote: post #68

Earlier quoted context omitted.

SPOILER ALERT I used this: 1'* alert()* ' (without the spaces needed for markdown here)

Could you explain why the * works in there?

JS does automatic type conversion in this case, so it's syntactically correct to multiply a string with a number (or function result). We're just interested in the side-effects of alert(), so it doesn't really matter what kind of expression we use it in, as long as it parses correctly and causes alert() to be executed (evaluated).

Re: Google's XSS game

#86

Post by sbd »

aetch wrote: post #53
jannes wrote: post #31

Earlier quoted context omitted.

For me it actually worked to use a script tag, but I'm confused about why, as the hint says it shouldn't. This is the URL I used: https://xss-game.appspot.com/level3/frame#'> alert('bla') But the hint is hinting at something more like this, I think: https://xss-game.appspot.com/level3/frame#' onerror="alert('bla')"> Can somebody explain why the first one worked? Are they wrong when they say that the browser won't exe…

Why do we need the single quote after the # sign? I don't understand why and would like to know.

in the chooseTab function you have the following line: html += "";

the src opens with a single quote and looks for the 'num' var. So instead of num in the URL, you close the single quote and then close the image tag, and then run your script.

Re: Google's XSS game

#88

Post by heroku »

heri0n wrote: post #79

on level 5 i tried to modify the url, but my quotes are automatically encoded, also tried encoding it using %22.. but didn't work.. I'm using chrome on osx, could it be a browser thing, i managed to get it to work by manually modifying the html using the developer tools :p

last hint helped me
Post reply on HN