[redlightrouter]

Hello all,

I made a little XSS challenge that's pretty advanced, not the hardest but also not the easiest.
I am very curious who of you can really think like a hacker and bypass this challenge I made.
This is the url:

http://xsschallenge.coolpage.biz/

I know alot of you guys will find the solution, but don't post it here ;).

Good luck :)
Spoiler (Click to View)



EDIT: I am hosting it on a different site than yesterday, that's why I double posted. Sorry for that.

[Faith Connors]

Damn it, got a solution but now my browser's XSS auditor pops up telling me it won't parse the request :P
Oh well, back to the drawing board.

[redlightrouter]

Damn it, got a solution but now my browser's XSS auditor pops up telling me it won't parse the request :P
Oh well, back to the drawing board.

Haha nice, keep it going.

---

Hint:
Spoiler (Click to View)
The app filters words like: alert, prompt and confirm. If there only was a way to split words and execute those splitted words all at once..

[j1nx0]

https://imgur.com/a/SytoA

nice challenge tho

[FormerlyS]

Thanks for the challenge

[sɪᴍᴏɴ]

lol I can't figure it out :( but again I don't have much experience in cross-site scripting :P

[redlightrouter]

Thanks for the challenge

Nice and thanks! Can you send me the vector you used in a PM? I am kinda curious how someone else would do this :)

---

https://imgur.com/a/SytoA

nice challenge tho

Nice and you also thanks! Can you also hit me a PM with your vector.

[semendaemon]

I cheated the shit out of this one. The alert hints it away ;)

[redlightrouter]

Yeah, my noob ass forgot to filter out prompt (lol). For everyone that did it with a vector like '... onerror=prompt(1)/>' try it again ^^

[semendaemon]

Yeah, my noob ass forgot to filter out prompt (lol). For everyone that did it with a vector like '... onerror=prompt(1)/>' try it again ^^

Will do, also filter out console.log while you're at it :p

[sɪᴍᴏɴ]

Lol 2 hours later and i have still not completed it ;(

[redlightrouter]

Lol 2 hours later and i have still not completed it ;(

Another hint and a pretty much a spoiler:
Spoiler (Click to View)
Imagine a guard on an airport that doesn't want H2o to be smuggled. The only thing he is checking for is H2o. So people with h2 can pass, people with o can pass, but once someone with H2o tries to get on the plane he gets denied. So if there's someone smart enough to think 'hey, let me bring h2 and o, and once I arrive in Columbia then I will make it H2o.' You pretty much get the same result, right?

This is the final hint since this is also a pretty big spoiler.

Succes 🤝

[Fộrcəd]

First attempt. (Kinda not legit method)
https://gyazo.com/ff9cb8c422422001cf3ae6e60310f52f

Update#2

Pretty darn close
https://gyazo.com/66473a6385f016ea30c9fa61d4204f4c

Just a matter of removing some '"' ?

[Faith Connors]

Pretty sure I have a solution, will update in a bit.
Turns out I'm on Chrome Canary and they have all kinds of beta nightly shit for anti-xss going on and it's being a real nazi with me.
Firefox seems to let some stuff go through and a lot of the stuff I try /seems/ to work but I just don't get the alert.

EDIT: Now Firefox is letting my request go through but removing my code zzzz

EDIT2: I HAVE A WITNESS TO PROVE IM NOT A 100% RETARD
https://i.gyazo.com/b51894698b25163110dc...176aa4.png

I HAD THE SOLUTION BEFORE BUT RAN INTO SOME PROBLEMS AND IM ONLY ABOUT 10-15% RETARDED

[Untraceable_Pro]

What are those variable _0x6ffd and how does the function spoiler work ?