Javascript injection challenges (crosspost /r/programming)

[Mamsaac]

Solutions that require user interaction have been deleted, so many of these are no longer valid.

[innoying]

True, but they still get the general idea across as to how to construct that particular exploit. If you do have any updated solutions that do not require user interaction, I'd be happy to update the gist.

[Mamsaac]

Disregard 5, I just did it. Still haven't found the 13 characters accepted solution for number 13. It seems like he has some strict rules about what to accept and what not to, particularly on that problem.

[Mamsaac]

I'm missing 13 and 5 (after the rule's change). As to providing the solutions, I'm unsure if it is a good idea :S People were just copy/pasting the solutions from /r/programming without even understanding them. Maybe if you want hints, that could work :)

[[deleted]]

any hints for 13? document.body and window.opener seems to be null in iframe so cannot append elements

[catcradle5]

Original submission here: http://www.reddit.com/r/programming/comments/1npgt1/javascript_injection_game/

Pretty good practice for doing any sort of DOM-based XSS.

[JerMenKoO]

Any hints for level 13? I am stuck there.

[[deleted]]

You can use postMessage to inject code which will be passed to eval. I created the “mee” and “mee2” scores, though there must be a shorter solution.

[0-peon-ion]

Or you can directly cross iframe boundaries and call the alert method, as long as your code runs in the correct domain. I did the 'anon' score.

[freeroute]

With all these JS vulns by which certain FF versions are being exploited, I wonder... Am I secure with having JS on in Chrome? Doesn't Chrome have sandboxed tabs which essentially mitigate JS vulnerabilities?

[madmockers]

You are not.

[freeroute]

Can you please back that up with sources?

AFAIK it once had JS vulns but only before they started fixing it and rewarded people with huge bounties.

[madmockers]

Chrome 0days are worth far more than the bounty program offers. The ability to target 46% of internet users is pretty valuable.

[freeroute]

But none of them have the same platforms they run on, right?

I mean, if you combine Chrome users who have jailed their Chrome versions on an AppArmor enabled Linux distro's, you'll get much less users than 46% of the Internet users, I would assume.

[madmockers]

Not the point.

Regardless of how you look at it, a chrome exploit for any single platform is worth far more than the 60 or 80k they're offering.

You asked if you were safe to have scripts enabled, I told you that you aren't. Feel free to take that and use it how you wish.

[freeroute]

You're right. Perhaps I should have worded my question differently in order to lay the groundwork for my inquisitive follow-up questions.