Hack The World

XSS game : Level 5 Write up 본문

Wargame/XSS game

XSS game : Level 5 Write up

Talkative 2020. 3. 23. 14:42

이 사이트의 기능은 회원가입을 하는데 이메일을 입력하고 넘기면 회원가입이되는 구조인거같다.

코드를 살펴보면

confirm.html

<!doctype html>
<html>
  <head>
    <!-- Internal game scripts/styles, mostly boring stuff -->
    <script src="/static/game-frame.js"></script>
    <link rel="stylesheet" href="/static/game-frame-styles.css" />
  </head>
 
  <body id="level5">
    <img src="/static/logos/level5.png" /><br><br>
    Thanks for signing up, you will be redirected soon...
    <script>
      setTimeout(function() { window.location = '{{ next }}'; }, 5000);
    </script>
  </body>
</html>

signup.html

<!doctype html>
<html>
  <head>
    <!-- Internal game scripts/styles, mostly boring stuff -->
    <script src="/static/game-frame.js"></script>
    <link rel="stylesheet" href="/static/game-frame-styles.css" />
  </head>
 
  <body id="level5">
    <img src="/static/logos/level5.png" /><br><br>
    <!-- We're ignoring the email, but the poor user will never know! -->
    Enter email: <input id="reader-email" name="email" value="">
 
    <br><br>
    <a href="{{ next }}">Next >></a>
  </body>
</html>

welcome.html

<!doctype html>
<html>
  <head>
    <!-- Internal game scripts/styles, mostly boring stuff -->
    <script src="/static/game-frame.js"></script>
    <link rel="stylesheet" href="/static/game-frame-styles.css" />
  </head>
 
  <body id="level5">
    Welcome! Today we are announcing the much anticipated<br><br>
    <img src="/static/logos/level5.png" /><br><br>
 
    <a href="/level5/frame/signup?next=confirm">Sign up</a> 
    for an exclusive Beta.
  </body>
</html>

singup.html 에서

next 를 href 태그로 받아서 값을 넘기는거같다.

href 태그이기에 간단하게 javascript:alert(1) 을 입력해주면 해결

'Wargame > XSS game' 카테고리의 다른 글

XSS game: Level 4 Write up  (0) 2020.03.13
XSS game: Level 3 Write up  (0) 2020.03.13
XSS game: Level2 Write up  (0) 2020.03.12
XSS game: Level 1 Write up  (0) 2020.03.12
공유하기 링크
'Wargame/XSS game' Related Articles more
Comments