Hack Forums
[Challenge] Don't Trust JavaScript Variables - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Challenge] Don't Trust JavaScript Variables (/showthread.php?tid=5904421)

[Challenge] Don't Trust JavaScript Variables - z_Goon - Nov 6, 2018

While hunting bugs, a reoccurring issue is trusting variables.

It really confuses me when JS is used to authenticate/display sensitive information.


Challenge:
Without editing the snippet below, change the Default Alert.

Code
w3schools.com/code/tryit.asp?filename=FWYYSLL94OSL

Code
var message = "Default Alert";

alert(message);

Post here when you've done it and PM me proof to verify.


Winners:
Code
No Winners Yet ;(


RE: [Challenge] Don't Trust JavaScript Variables - Abruptum - Nov 6, 2018

(Nov 6, 2018 12:50 PM)z_Goon Wrote:  While hunting bugs, a reoccurring issue is trusting variables.

It really confuses me when JS is used to authenticate/display sensitive information.


Challenge:
Without editing the snippet below, change the Default Alert.

Code
w3schools.com/code/tryit.asp?filename=FWYYSLL94OSL

Code
var message = "Default Alert";

alert(message);

Post here when you've done it and PM me proof to verify.


Winners:
Code
No Winners Yet ;(

Well maybe i am too stupid but this would fuck up the js world in a global score if this works.
Look here https://security.stackexchange.com/questions/134240/modify-javascript-variable-with-url-exploit
This will not work...