[redlightrouter]

Hey all,

I've made another xss challenge. Difficulty level is low to medium, but do not underestimate it.
XSS Challenge

Don't forget to PM me your solution :)

Good luck 🤝

Spoiler (Click to View)

[Faith Connors]

you were right i am getting a headache

edit: figured out a possible vector. tooko a bit of setup though lol. pming soon and adding screenshot.

screenshot added:

[redlightrouter]

***************

Nice one, but unfortunately it's not what I had in mind.


HINT: Look at the source code

[Kashmiri Hunter]

0x00 - Payload Sent !
Thanks !

[Nomad.Null]

Nice one, but unfortunately it's not what I had in mind.


HINT: Look at the source code

An XSS is an XSS ✌

[redlightrouter]

An XSS is an XSS ✌

I guess that's what you could call it, yeah :p.

---

0x00 - Payload Sent !
Thanks !

Nice, you got it right :)

[Lsd-r2]

Bro have you a sqli test/games??

[redlightrouter]

Bro have you a sqli test/games??

Nope sorry. I consider myself a noob in SQL, so I don't really know how to make an interesting challenge. I know how to make the standard/basic/too often used challenge, but like I said it's literally everywhere.

[THC]

Belongs here I think.
Website Hacking

[redlightrouter]

I guess it's time for a little write up.
Spoiler (Click to View)
So these are being filtered:

PHP Code


<?php 
$blacklist = array('(',')','alert','eval','prompt','confirm','atob','&lt;script&gt;','&','javascript','data','\u{61}','http','https'); 


Changing those words to uppercase won't work since it will be treat as lowercase.

PHP Code


<?php 
    foreach($blacklist as $i)
    {
        if(strpos(strtolower($_GET['xss']), $i))
        {
            $_GET['xss'] = '1';
        }
    } 


EDIT: Something went wrong so I made a shorter version.
So what basically happens is that the once we try our basic img src payload it filters parentheses and alert,confirm and prompt.

In javascript it's possible to use unicoded letters in functions etc.
so instead of a normal alert I use a\u{6C}ert() ( or a\u006cert() )

Now the only thing that gets filtered are the parentheses.

In javascript it is also possible to use backticks ( ` ) as parentheses. The only thing is that the given argument will be handles as a string.

so the final payload is:

PHP Code


<?php 
&lt;img src=x on*error="a\u{6C}ert``" &gt;

REMOVE * 


Thanks for your submissions!

[Alim]

Sorry, again i arrived later.

I found the solution before seeing the answers.

prntscr .com/fyy613

Thanks.