# How can this xss challenge be solved? [closed]

I found this : http://research.insecurelabs.org/xssmas/

And so far my solutions were:

``````1.http://research.insecurelabs.org/xssmas/search.php?query=<script>alert(0)</script>
``````

but there seem to be five solutions.Can anyone help me I'm trying to learn more about XSS. thanks

``````UPDATED:

I know that two other solutions are related to this:
1.
<script>
var n = '';
if (n != '') {
\$(function() {
\$("h1").html("Merry XSSmas, " + unescape(n) + "!");
});
}
</script>

2.

<script>
<!-- Analytics: no change below this line -->
document.write('<img src="analytics?url=">');
</script>

Update solved no2:

``````
-

## closed as not constructive by rook, schroeder♦, Polynomial, Scott Pack, Rory Alsop♦Dec 30 '12 at 11:50

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

the point of a challenge is to test your skills... asking for the solutions doesn't help. – rook Dec 28 '12 at 0:10
I don't see where the solutions were asked for. I see where it is stated there are 5 solutions, and I see a request for assistance. Maybe someone pointing or "nudging" in the right direction would be possible? – Everett Dec 28 '12 at 0:31
I have updated my thread , just want to know how can I access those values. Thanks – khaomax Dec 28 '12 at 11:49
As the author behind the challenge, here are the intended solutions: research.insecurelabs.org/xssmas/solutions.html – Erlend Jan 1 '13 at 19:36
Thanks the jquery one gave me a real headache , but three of 5 for a beginner is not bad, and btw nice challenge. – khaomax Jan 1 '13 at 19:49

If you are trying to learn, then asking for others to answer the question for you seems counter-productive.

Check out cheatsheets and other material to work through it all.

-
I have updated my thread , just want to know how can I access those values. Thanks – khaomax Dec 28 '12 at 11:49
This seems like it should be a comment. – Abe Miessler Nov 7 '14 at 5:41
@AbeMiessler Yep. 2 years ago, the lines were drawn slightly differently. – schroeder Nov 7 '14 at 17:02

While I strongly agree with everybody who said that since this is a challenge and you should solve it on your own, I have to say that this is, after all, a Q&A site. You have asked a question and, if I'm able to, I'll answer it. What you do with that answer is your own responsibility.

That said, I recommend that you only continue reading if you tried very hard and couldn't find an answer.

After some fuzzing I found that there's something interesting with `research.insecurelabs.org/xssmas/index/analytics`, it appears that anything passed to it (`analytics?SOMETHING`) is written here `document.write('<img src="analytics?url=SOMETHING">');`

Trying with `.../xssmas/index/analytics?<script>alert(0)</script>` yielded no result, so I decided to test the classic `onerror`:

``````.../xssmas/index/analytics?<img src="giveMe404" onerror="alert(0)">
``````

And it worked.

Good luck finding the rest!

-
Thanks , I think first three were easy but others will be very hard , will try my best. Hvala – khaomax Dec 28 '12 at 16:51

Trying with `.../xssmas/index/analytics?<script>alert(0)</script>` yielded no result, so I decided to test the classic onerror:

You should imagine how look like server page script... it could be sth like that:

```<script> <!-- Analytics: no change below this line --> document.write('<img src="analytics?url=<?php echo \$variable; ?>">'); </script>```

Your example would work but you need "clear out" rest of unnecessary JS code - I mean: `">');`

-