I have been doing this challenge and I came across a super hard level that I think its all about DOM XSS.
I know it because I don't get any response from the server side and everything I insert won't reflect back because of brutal escaping.
Here is the source code of the page:
<html>
<body>
<script src="analytics.js"></script>
<p>
your cool xss
</p>
<script>
var queryDict = {};
location.href.substr(location.href.indexOf('?')+1).split("&").forEach( function(item) {
queryDict[item.split("=")[0]] = item.split("=")[1]
});
a = '';
b = document.write('<b>' + decodeURIComponent(queryDict.p) + '</b>');
</script>
<!-- use your head and not automatic scanners like burp.. it will not help -->
</body>
</html>
Any help please?
#
? – grc Aug 25 '16 at 9:32