This question already has an answer here:

I'm trying to understand how XSS works, and I bumped into Google's XSS games (https://xss-game.appspot.com/).

Level 1 is easily solvable with the most common XSS (<script>alert(0)</script>). However, if you try this on level 2 it doesn't work. It is solvable loading an img with the alert code inside an onerror: attribute. However, I'm trying to understand how does it filter the script tags, and after putting them, I see them in the servers response EXACTLY how I entered them (but with no alert message). As I understand it, if the browser sees an <script>alert(0)</script>, it always executes it. All the solutions for XSS that I know of involve filtering the content before displaying it.

So my questions are, how is Google preventing the XSS to work, and under which conditions would a browser see HTML code with <script>alert(0)</script> and not execute it?

Edit: the first question was a duplicate, and the answer is by putting the content inside an innerHTML. However, the second question remains, is there any other way to implement this?

marked as duplicate by Anders, WhiteWinterWolf, LvB, Steffen Ullrich, Rory Alsop Jun 24 '16 at 22:48

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    Make sure that what you're seeing is actually what is being returned. Browser dev tools sometimes "helpfully" parse HTML entities - you might need to view raw source to see some things cleanly. – Matthew Jun 21 '16 at 15:04
  • To answer your second question: A CSP could also prevent scripts from being executed. – Anders Jun 21 '16 at 15:29

You can find the answer if you peak at the source code.

The <script> tag does not work because the HTML is not generated by a Python script simply echoing the user input, as in Level 1. Instead, the user input is contained in a JSON file and it is displayed on the page with the help of some JavaScript:

html += '<b>You</b>';
html += '<span class="date">' + new Date(posts[i].date) + '</span>';
html += "<blockquote>" + posts[i].message + "</blockquote";
html += "</td></tr></table>"
containerEl.innerHTML += html;

The key part here is the innerHTML attribute. It does not allow <script> tags - they are ignored by the browser - but it does allow event attributes such as onerror. Do note that there is no explicit escaping done in the code - it is just the security mechanisms built into the browser at work here.

In other words, this is an example of DOM-based XSS. The Mozilla documentation gives a good explanation of it under "Security considerations".


About your second question, the main idea is to understand what is part of the code and what is part of the application data, then you should think how the application data are validated or encoded , for example, if you have a search function, you might have something like this:

<input id="search" name="search" value="something" />

If you replace something for the next string: " /><script>alert("XSS");</script><input type="hidden" value="" id="other; you will have the next result:

<input id="search" name="search" value="" /><script>alert("XSS");</script><input type="hidden" value="" id="other" />

The browser will interpret everything as code, because the developer never indicates what is code and what is application data.

If the developer decides to delete the strings <script> and </script> when you introduce an input data on the search field, you can try with " onmouseover="alert(XSS);" /><input type="hidden" value="" id="other, the result will be the following:

<input id="search" name="search" value="" onmouseover="alert(XSS);" /><input type="hidden" value="" id="other" />

The browser will interpret everything as code again, but when the user places the mouse on the search field, the XSS will be executed due the event onmouseover.

Then, all depends on how the application validates the input data or encode the data on the browser, you have to try diferents ways to exploit it. I share you a interesting web site about that.


I hope this information helps you.

Not the answer you're looking for? Browse other questions tagged or ask your own question.