ST01: XSS Challenge (Solved)

Hack The Box Challenge
1

maxresdefault%20(Phone)

Hi Everyone.
I’m really happy to see that you all are enjoying this forum. It’s an acknowledgment of my assiduity.

It’s an XSS challenge (GAME) for everyone. Let’s see who can do it.

Go to: http://104.129.171.125/xss-ct1/

Note:

  • The challenge in under this path /xss-ct1/
  • POC done by automation XSS tools are not accepted.

Scoreboard

The result is based on the explanation of the problem and the manual injection technique.

  1. @Shouvo :star:
  2. @Exploit-Baba

Thanks.

2 Likes
2

Did you get something? Bro !
@Sameull @Kharap_Atta @Shouvo

1 Like
3

akhn o na

1 Like
4

Tried… :roll_eyes:

"><img src=1.gif onerror=alert(document.cookie)>
"><img src=1.gif onerror=alert(document.domain)>
"><img src=1.gif onerror=alert('XSS')>
"/><svg/onload=prompt(document.domain)>
/><script>prompt(document.domain)</script>
5

not working :frowning:

6

Got it… :sunglasses: but no popup :japanese_goblin:
image

7

yaaaap…no popup

8

HI @Shouvo Yes it is hard to make popup… but if you try to do closer like popup or browser alert; It is accepted. Nice try @Exploit-Baba :slight_smile:

1 Like
9

Does the expected solution work on modern browsers?

10

in windows 10 , browser alert not showing … i think :frowning:

11

Firefox in linux detects the url reroute if it’s executing an script :frowning:

12

@1337

13

@Shouvo @santner In modern web browser it may not works… In windows 10 you can use Internet Explorer with disabling XSS filter. To Disable:

Follow these steps to disable XSS filter.

a. Open Internet Explorer and click on Tools .
b. Click on Internet Options and then select Security tab .
c. Click on Custom level .
d. Under Scripting select disable XSS filter and click Ok .
e. Close the window and restart Internet Explorer.

14

Then I am done :3 How can send the POC?

15

@santner Great.
Inbox me.

16

i think this challenge is vulnarable :stuck_out_tongue:
you must think about that …

17

Googling will help :wink:

18

@Shouvo Try a little bit… You can generate the popup. :+1:

19

only internet explorar or any browser show this ?

1 Like
20

I got the popup in Internet Explorer -7… :hugs:

1 Like