Google's XSS game
xss-game.appspot.com
Google's XSS game
1–10 of 168 posts
Re: Google's XSS game
#2.
Re: Google's XSS game
#3[deleted]
Re: Google's XSS game
#4For those interested in XSS challenges, there's also http://escape.alf.nu , which I think has a slightly better UI.
Re: Google's XSS game
#5I completed the game, but I honestly don't know: why wouldn't inject a script tag directly in level 2 work?
Re: Google's XSS game
#6I completed the game, but I honestly don't know: why wouldn't inject a script tag directly in level 2 work?
The hint for level 3 reads:
As before, using ... as a payload won't work
because the browser won't execute scripts added after the
page has loaded.
Re: Google's XSS game
#7I completed the game, but I honestly don't know: why wouldn't inject a script tag directly in level 2 work?
The hint for level 3 reads: As before, using ... as a payload won't work because the browser won't execute scripts added after the page has loaded. How do you solve level 3?
try '>
Re: Google's XSS game
#8I completed the game, but I honestly don't know: why wouldn't inject a script tag directly in level 2 work?
The hint for level 3 reads: As before, using ... as a payload won't work because the browser won't execute scripts added after the page has loaded. How do you solve level 3?
Similar to level 2 - just be careful about escaping out of the image src, and making sure the rest of the line is invalidated. Think about how you would do it if you were writing JS on your own...
Re: Google's XSS game
#9Re: Google's XSS game
#10Nice one; I gave up trying to solve the last with the http-only google.com/jsapi and hosted my own with https, but then it occurred to me that it's even more trivial than I thought!
Checking our stuff for this mistake now ...