Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm trying to solve @kinugawamasato xss challenge
https://vulnerabledoma.in/xss_2020-06/
It's a php script that receives a argument, escapes it and create he following tag on the html:
<script src="/xss_2020-06/check_code.php?callback=callback&code=PARAM"></script>
So PARAM is the argument. The maximum payload is 10 chars
This is not a platform to solve CTF excercises. Still I had a look and will give you a hint:
When requesting check_code.php?callback=callback&code=PARAM you pass two arguments.
Your result is callback("Invalid code: 'PARAM'").
Don't focus too much on the code parameter.
It's a very easy CTF task
