News for hackers. Stuff that matters.

A comment on Google's XSS game. Parent comment

Re:Google's XSS game by yen223 on Thursday May 29, 2014 @07:02AM (#7815636)
What's the trivial solution to this? I also wound up hosting the malicious file on my personal server...
[ Parent | on HN ]
Re:Google's XSS game by trias on Thursday May 29, 2014 @07:28AM (#7815687)
data-uris also work: #data:text/javascript,alert('pwn')
[ Parent | on HN ]
Re:Google's XSS game by aidos on Thursday May 29, 2014 @08:24AM (#7815844)
That's what I used too. Hosting scripts is far too much like hard work...
[ Parent | on HN ]
Re:Google's XSS game by hrrsn on Thursday May 29, 2014 @07:57AM (#7815740)
There are apparently easier ways, but I just chucked an alert(); in my Dropbox public folder, did an //dl.dropboxusercontent.com/u/14XXX/xss.js as they serve both http and https.
[ Parent | on HN ]
Re:Google's XSS game by joshschreuder on Thursday May 29, 2014 @08:15PM (#7819428)
I put a small gist up and hotlinked through githack.com
[ Parent | on HN ]