Test your javascript skills | XSS challenge

Test your javascript skills | XSS challenge - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Test your javascript skills | XSS challenge (/showthread.php?tid=5483982)

Pages: Pages 1 2 3

Test your javascript skills | XSS challenge - redlightrouter - Dec 4, 2016

Hello all,

I made a little XSS challenge that's pretty advanced, not the hardest but also not the easiest.
I am very curious who of you can really think like a hacker and bypass this challenge I made.
This is the url:

Quote:http://xsschallenge.coolpage.biz/

I know alot of you guys will find the solution, but don't post it here ;).

Good luck :)
Spoiler (Click to View)

EDIT: I am hosting it on a different site than yesterday, that's why I double posted. Sorry for that.

* - Faith Connors - Dec 4, 2016

Damn it, got a solution but now my browser's XSS auditor pops up telling me it won't parse the request :P
Oh well, back to the drawing board.

* - redlightrouter - Dec 6, 2016

(Dec 4, 2016 02:55 PM)Faith Connors Wrote: Damn it, got a solution but now my browser's XSS auditor pops up telling me it won't parse the request :P
Oh well, back to the drawing board.

Haha nice, keep it going.

Hint:
Spoiler (Click to View)

* - j1nx0 - Dec 6, 2016

https://imgur.com/a/SytoA

nice challenge tho

* - FormerlyS - Dec 6, 2016

[Image: c4748a318839ab61f531982c9b2f6a2f.png]

Thanks for the challenge

* - sɪᴍᴏɴ - Dec 6, 2016

lol I can't figure it out :( but again I don't have much experience in cross-site scripting :P

* - redlightrouter - Dec 6, 2016

(Dec 6, 2016 10:19 AM)FormerlyS Wrote:

Thanks for the challenge

Nice and thanks! Can you send me the vector you used in a PM? I am kinda curious how someone else would do this :)

(Dec 6, 2016 09:49 AM)j1nx0 Wrote: https://imgur.com/a/SytoA

nice challenge tho

Nice and you also thanks! Can you also hit me a PM with your vector.

* - semendaemon - Dec 6, 2016

I cheated the shit out of this one. The alert hints it away ;)
[Image: QiT52Sc.png]

* - redlightrouter - Dec 6, 2016

Yeah, my noob ass forgot to filter out prompt (lol). For everyone that did it with a vector like '... onerror=prompt(1)/>' try it again ^^

* - semendaemon - Dec 6, 2016

(Dec 6, 2016 02:28 PM)redlightrouter Wrote: Yeah, my noob ass forgot to filter out prompt (lol). For everyone that did it with a vector like '... onerror=prompt(1)/>' try it again ^^

Will do, also filter out console.log while you're at it :p

* - sɪᴍᴏɴ - Dec 6, 2016

Lol 2 hours later and i have still not completed it ;(

* - redlightrouter - Dec 6, 2016

(Dec 6, 2016 02:58 PM)Siimon. Wrote: Lol 2 hours later and i have still not completed it ;(

Another hint and a pretty much a spoiler:
Spoiler (Click to View)
This is the final hint since this is also a pretty big spoiler.

Succes 🤝

* - Fộrcəd - Dec 6, 2016

First attempt. (Kinda not legit method)
https://gyazo.com/ff9cb8c422422001cf3ae6e60310f52f

Update#2

Pretty darn close
https://gyazo.com/66473a6385f016ea30c9fa61d4204f4c

Just a matter of removing some '"' ?

* - Faith Connors - Dec 6, 2016

Pretty sure I have a solution, will update in a bit.
Turns out I'm on Chrome Canary and they have all kinds of beta nightly shit for anti-xss going on and it's being a real nazi with me.
Firefox seems to let some stuff go through and a lot of the stuff I try /seems/ to work but I just don't get the alert.

EDIT: Now Firefox is letting my request go through but removing my code zzzz

EDIT2: I HAVE A WITNESS TO PROVE IM NOT A 100% RETARD
https://i.gyazo.com/b51894698b25163110dc285974176aa4.png

I HAD THE SOLUTION BEFORE BUT RAN INTO SOME PROBLEMS AND IM ONLY ABOUT 10-15% RETARDED

* - Untraceable_Pro - Dec 6, 2016

What are those variable _0x6ffd and how does the function spoiler work ?