hi, im new to xss. you gave the site, i tried but it didnt work or i may be i work it wrong. could you help me how to do this workshop. i just put the code in the textbox and then press the button but i didnt get any message.

@ hur
a place to start: http://www.w3schools.com/js/default.asp

pretty sure I just copied the decryption js, made my own page with the hidden form stream data and updated the form data for each page, running the script on my own machine.. cheat = win

on a more serious note - what the hell is with stage 3.. i feel like a retard :| (edit: wtf, as if a url injection counts? what is this, baby school... :Z) and now 6 won't fuck off with the double quote at the end of my injection (ie: &lt;script>blahblah&lt;/script"> WHY WONT YOU LEAVE ME ALONE DOUBLE QUOTE I DON'T WANT TO USE ONBLUR. ><)

EDIT: Ok wtf? how does

">&lt;img src=. onError="javascript:decipher(document.forms.cipher); alert(document.forms.cipher.stream.value); document.forms.cipher.stream.value = document.forms.cipher.stream_copy.value;

not return my error.. the injection is coming up as

<img src=. onError="javascript:decipher(document.forms.cipher); alert(document.forms.cipher.stream.value); document.forms.cipher.stream.value = document.forms.cipher.stream_copy.value;">

on the page. Looks completely 100% fine to me.. it's just not executing my script. I've done this 1000 ways, none of them execute, they just LOOK correct. zz

edit (last): finally got the bitch.. was no different to my first attempts, it just started working. z z z z z



Edited 7 time(s). Last edit at 02/21/2008 09:47PM by fragge.

Many thanks here!
I've passed all the stages,and obtained a lot!
I'm an XSS novice.
I think it is a very good Exchange platform here.

SPOILER!!!
Stage 6










http://blogged-on.de/xss/6.maxsize.php?input=%22%20onblur=%22javascript:decipher(document.forms.cipher);%20alert(document.forms.cipher.stream.value);%20document.forms.cipher.stream.value%20=%20document.forms.cipher.stream_copy.value

any bright ideas on how to get past a regex filter on ":" (colon)? this makes any javascript:xxxx impossible.

Quote

any bright ideas on how to get past a regex filter on ":" (colon)? this makes any javascript:xxxx impossible.

Thank you for reviving this old topic, but please stick to your original thread and try bumping that up to see if you get other responses.

--thrill

---

It is not the degrees you hold, but the mind you possess. - thrill

Hi w0ts0n

I am new in XSS thing and stuck into stage 3, help me please :).

Hello,
I am newbie with XSS and have reached level 6, but cannot get beyond it.

From the description it seems that the script tags will be parsed out, and it is visible in the text reflected back on the screen. I have tried to use handlers like

http://blogged-on.de/xss/6.maxsize.php?input="onload="decipher(document.forms...."

which does not seem to work. Can someone please provide me with some idea as to how to get past this. I have also tried <scri"pt>,<scr<script>ipt> and some other variations but have not been successful.

There is a solution posted in this thread but that does not work either. Should I think about obfuscating the tags?

Thanks,
-A

Great Success!!

There might be an easier way to pass stage 6, but read about how .mario xssed this registration page for one such method

thornmaker Wrote:
-------------------------------------------------------
> There might be an easier way to pass stage 6, but
> read about how .mario xssed this registration page
> for one such method


Thanks thornmaker, I tried out input=" onload=alert(1) a=" but got nowhere. I also tried out the name.xss link described in the post, and ended up at the "bad boy" page :-D .

I also went thru http://sla.ckers.org/forum/read.php?2,20942 , but still am a bit confused about how to get past this.

Thanks anyways,
-A

check out this list of html tags to see what events go with each html tag. Note that onload does not work in an input tag (for IE, FF, and Safari at least)

wow! thanks.. its a useful list :-)

However, I used the input= thingy because in the source html I can see the value passed to the backend has the name input. Its a param, and does not seem to correlate with a html tag.

Do correct me if I am mistaken.

I did try onmousemove etc.. but it makes no difference :-(

Thanks,
-A

Great Success!!

Just replace onload in your example by onclick and click on the bloody input element ;)

Thanks mario .. the solution was so in-the-face.. ughhh!

-A

leavel 1
http://h4k.in/xssinexcess?title=%3C/title%3E%3Ccenter%3E%3Cb%3EHelo%20Admin%20Tried%20to%20increase%20the%20security%20of%20your%3Cbr%3EMessage%20by%20Abo-Ebrahem%3Cbr%3Ewww.7rs.org%3Cbr%3E



Edited 1 time(s). Last edit at 04/11/2009 03:56PM by abo-ebrahem.

Hi,

I'm completly new to XSS, but I want to learn everything about it.

All the workshop sites in this thread are down.

Anyone can tell me where I can find a good tutorial or ebook for a XSS beginner?