Re:Google's XSS game
by sbd on Thursday May 29, 2014 @10:58AM
(#7816529)
in the chooseTab function you have the following line:
html += "<img src='/static/level3/cloud" + num + ".jpg' />";
the src opens with a single quote and looks for the 'num' var. So instead of num in the URL, you close the single quote and then close the image tag, and then run your script.
the src opens with a single quote and looks for the 'num' var. So instead of num in the URL, you close the single quote and then close the image tag, and then run your script.