Google XSS game challenge
XSS Game
Google set up this beginer friendly game environment back in 2014 but solving it after a decade still have fun and learning. In this game you just need to trigger a alert() on the page by execution of xss. If you want to try them yourself, visit: https://xss-game.appspot.com/.
Levels
Level 1: Hello, world of XSS
Level 2: Persistence is key
Level 3: That sinking felling…
Level 4: Context matters
Level 5: Breaking protocol
Level 6: Follow the 🐇
What is Cross Site Scripting
Cross Site Scripting (XSS) are type of injection, in which malicious script are injected into trusted website. There are basically three types of XSS:
1. Reflected
2. Stored
3. DOM based
> For more information about XSS types visit: https://owasp.org/www-community/Types_of_Cross-Site_Scripting
Level 1: Hello, world of XSS
In this application there is input box. If you search something then it will reflected in the response with bold.
So now try some HTML tag here like <h1>
It is reflected as h1 heading.
Now try to execute the javascript payload via html tag here. For inserting the javascript in the html page we can use the <script> tag. Now try the input of <script>alert(`1`)</script>
Alert is triggered. This is example fo reflected XSS (also known as non persistent XSS) where payload is directly reflected to web page.
Level 2: Persistence is key
This is a chat application. Where data is stored in the database and retreive on user request. It is the example of stored XSS and affect all the user who receive the data.
<h1> tag is working here as well but <script> tag is not working. For execute javascript we can use another tags like <svg> or <img> with events such as onload and onerror. We used the paylod : <img src=x onerror=alert()>
Our payload is working here. This is example of stored or persistent XSS.
Level 3: That sinking feeling…
In this application there are no input form on the page but it have some buttons which loads the images. On clicking the image button we can observe the change in the url hash. Eg #1, #2, #3.
Get Harsh Sharma’s stories in your inbox
Join Medium for free to get updates from this writer.
Analysis the target code with toggle button.
The hash value in url is stored in var num (line 20) and it is sink into the html var as string concatenation (line 17). We can use the payload where num value is "’ onerror=alert()>explanation: we are closing the quotes then add event based action and then close the tag.
Broken link image execute the alert().
Level 4: Context matters
This is a timer application. The application alert when the countdown is finished. On trying the html payload 1000<h1>harsh</h1>
On viewing the frame source code, the following is observed
The payload is encoded. If we try the ' (single quote) with the payload of 1000'we observed that the syntax error is generated.
So correct the syntax by input of 1000')(' we observe that the TypeError generated.
We need to concatenate the function by using the , or | . Therefore we are using the payload: 1000')|(' . we observed that no error generated. Now insert the alert() by using the final payload of 1000')|alert(' .
Level 5: Breaking protocol
In this application there is signup page where is Enter Email form, go button besides the url and next link below the form.
we observed that that the next link and next parameter in the url are connected. Default next link value is https://xss-game.appspot.com/level5/frame/signup?next=confirm which is same as url https://xss-game.appspot.com/level5/frame/signup?next=confirm. If we change the nextparameter value in the url and submit with go button then our next link value also changes.
On submit the next parameter value of https://example.com we observe that on click the next link after enter the mail it redirects to the https://example.com/ . This attack is also known as open redirect.
Now we can use the javascript protocol here with the payload of javascript:alert() . It pop up the alert.
Level 6: Follow the 🐇
In this application accessing the js file and executing it. So if we try to add the external js file url https://example.com/file.js . It response with this:
With the code analysis we observed that regex only check the input that contains http in small characters. so we can escape this with capital characters. Therefore we insert the Http://example.com/file.js . It responded with:
This error is due to CORB
Our code is only prevent the payload which contains http. It still remains other scheme unchecked like data url . we can insert the js code with the data:text/javascript,alert()
BOOM! we have completed this challenge
Conclusion
This game was really fun and introduces the basics of XSS which is common vulnerability of OWASP top 10.
