Welcome to xssy Discussions! #5
Replies: 11 comments 67 replies
-
|
Great resource Paul. Thanks. |
Beta Was this translation helpful? Give feedback.
-
|
Href XSS Lab how i can pass this |
Beta Was this translation helpful? Give feedback.
-
|
sir can you recommend me any real life xss sir i learn all thing but what i can do next how i can find target and can i can do next sir plz can u help me |
Beta Was this translation helpful? Give feedback.
-
|
The labs on XSSy are all based on various real world scenarios. Beyond that, the stickied post on /r/xss has a bunch of good resources. I recommend starting there. |
Beta Was this translation helpful? Give feedback.
-
|
sir your help can change my life |
Beta Was this translation helpful? Give feedback.
-
|
sir i msg you |
Beta Was this translation helpful? Give feedback.
-
|
solo name |
Beta Was this translation helpful? Give feedback.
-
|
Href XSS Lab |
Beta Was this translation helpful? Give feedback.
-
|
hello sir im having trouble with the no brackets lab and i dont like this but im seriously stuck <img src=x onerror=alert |
Beta Was this translation helpful? Give feedback.
-
|
its the new lab by gr4y-r0se not the Brackets Filtered XSS one i tried but it did not quite work |
Beta Was this translation helpful? Give feedback.
-
|
Oh my bad, let's see... For that one I do basically the same thing as previously, but inside of an onerror in an img tag because of the way it uses innerHTML. |
Beta Was this translation helpful? Give feedback.
-
|
okay thanks alot did think about that i was stuck trying to figure out a way using backticks |
Beta Was this translation helpful? Give feedback.
-
|
but sir this payload work in modern browsers |
Beta Was this translation helpful? Give feedback.
-
|
Blocked if CSP is strict or alert() is blacklisted |
Beta Was this translation helpful? Give feedback.
-
|
hey @paj28 sir is the site down or is it just me ?? |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for letting me know, I have restarted it and seems ok for now. Think something has been hitting the site with high traffic. |
Beta Was this translation helpful? Give feedback.
-
|
hi Paul, I found a way to solve one of the labs (Lab: HTML Filter - Attribute Bypass) which will pop cookies for me each time but the headless browser seems to error out each time with - Error accessing headless browser. Please try again later. However, if I give invalid payload, it will correctly say that no alert with cookies detected, have you got any advise? Not sure if its wise to share the payload here for other to see to do not spoil challenge for others :) |
Beta Was this translation helpful? Give feedback.
-
|
Hi @sarbjeetsandhu700-tech I'd encourage you to watch the solution video for the Capture Cookie lab as it shows some of these techniques |
Beta Was this translation helpful? Give feedback.
-
|
Ok |
Beta Was this translation helpful? Give feedback.
-
|
Xxxx i replace with my lab url |
Beta Was this translation helpful? Give feedback.
-
|
<img+src="https://my lab url |
Beta Was this translation helpful? Give feedback.
-
|
Please keep the double posting to a minimum and give more consideration to your messages. I'm getting a notification for every message and it's frustrating. |
Beta Was this translation helpful? Give feedback.
-
|
hello @paj28 can you explain me CSP - Injection Bypass this lab |
Beta Was this translation helpful? Give feedback.
-
|
and @MechaTech84 |
Beta Was this translation helpful? Give feedback.
-
|
Look where the lang parameter injects - it's within the CSP. You can't inject 'unsafe-inline' because single quotes are escaped, but you can inject your payload hosting lab. You need some care due to the trailing .js. I created alert.js on my payload hosting, and set lang to the URL of that, but with .js removed. You can then inject a script tag into the name parameter: |
Beta Was this translation helpful? Give feedback.
-
|
CSP - Predictable Nonce Bypass how we bypass csp |
Beta Was this translation helpful? Give feedback.
-
|
Sir |
Beta Was this translation helpful? Give feedback.
-
|
sic can you explain me |
Beta Was this translation helpful? Give feedback.
-
|
@paj28 sir |
Beta Was this translation helpful? Give feedback.
-
|
One of the most important skills in information security is being able to solve problems with logical analysis, independent research, and trial and error. You need to back up and learn more about HTTP, JavaScript, HTML, etc. so you understand the problem and can start looking for ways to solve it. |
Beta Was this translation helpful? Give feedback.
-
|
@MechaTech84 thx sir for your advice i bypass it. |
Beta Was this translation helpful? Give feedback.
-
|
I love the resource, cheers for putting it together! |
Beta Was this translation helpful? Give feedback.
-
|
Hi Jack, thanks for your message. I have noticed you getting busy on the labs and keeping MecaTech on his toes :) The lab you submitted recently is a really tough one, took me a while! BTW, did I see you at BSides Leeds? |
Beta Was this translation helpful? Give feedback.
-
|
I kept chasing red herrings on that one... I spent so many hours trying to get emojis to decode because of the title and then even more hours trying to figure out how to change the encoding or language because those tags aren't in the default template... |
Beta Was this translation helpful? Give feedback.
-
|
Sorry, hahaha, I used a variable which was in Burp Intruder's |
Beta Was this translation helpful? Give feedback.
-
|
Jack, there are a few length limit labs now. Can I ask you to rename your LimitLength to "Length Limit Bypass" |
Beta Was this translation helpful? Give feedback.
-
|
I quite like the emoji in the title. Any particular tool it f issues with?
Burp was fine.
But yeah, could do with don ny an actual HPP request, have have a clue
about the encoding param name.
…On Mon, 8 Dec 2025 at 12:49, MechaTech84 ***@***.***> wrote:
I kept chasing red herrings on that one... I spent so many hours trying to
get emojis to decode because of the title and then even more hours trying
to figure out how to change the encoding or language because those tags
aren't in the default template...
—
Reply to this email directly, view it on GitHub
<#5 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAOOTXIU5CFOBIZKHX5CSML4AVXWFAVCNFSM6AAAAACB6BDEO2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKMJZGYYDKNQ>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
No issues, I just thought it was a clue and kept trying to find a Unicode character that turned into |
Beta Was this translation helpful? Give feedback.
-
|
can I make a video about a challenge that doesn't have a video yet? @paj28 |
Beta Was this translation helpful? Give feedback.
-
|
Oh yeah, that would be great. If you let me know the URL when you're done I'll review and add it. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
👋 Welcome!
We’re using Discussions as a place to connect with other members of our community. We hope that you:
build together 💪.
To get started, comment below with an introduction of yourself and tell us about what you do with this community.
Beta Was this translation helpful? Give feedback.
All reactions