News for hackers. Stuff that matters.

A comment on Google's XSS game. Parent comment

Re:Google's XSS game by aetch on Thursday May 29, 2014 @08:47AM (#7815933)
Why do we need the single quote after the # sign? I don't understand why and would like to know.
[ Parent | on HN ]
Re:Google's XSS game by HackyGeeky on Tuesday June 03, 2014 @05:01PM (#7842701)
As "sbd" said, the "html +=" statement is using the "num" parameter as it is.

The real problem is the substring(1) function which passes the "num", instead of making sure the length is 1 it is allowing everything.

[ Parent | on HN ]
Re:Google's XSS game by sbd on Thursday May 29, 2014 @10:58AM (#7816529)
in the chooseTab function you have the following line: html += "<img src='/static/level3/cloud" + num + ".jpg' />";

the src opens with a single quote and looks for the 'num' var. So instead of num in the URL, you close the single quote and then close the image tag, and then run your script.

[ Parent | on HN ]