Web - Client

Monday 27 July 2020, 23:49  #1
Web - Client|DOM XSS
ryzen2511
  • 7 posts

I found that a certain word is filtered out and replaced with this: "( ͡° ͜ʖ ͡°)". Ive been trying to bypass the filter but it doesnt seem possible. Is the filtered word needed to pass the challenge or should I try something else?

Tuesday 28 July 2020, 00:14  #2
Web - Client|DOM XSS
ElTouco72
  • 283 posts

find a way the use the filtered word differently young padawan

Tuesday 28 July 2020, 05:30  #3
Web - Client|DOM XSS
ryzen2511
  • 7 posts

OK thnks. Do I have to do anything with the try function? I can invoke it but there is a property error.

Tuesday 28 July 2020, 09:57  #4
Web - Client|DOM XSS
ElTouco72
  • 283 posts

try and fail.
Retry and fail better.

By the way, do you think it makes sense to start by the hardest chall in webclient section when when haven’t done any others ?

Tuesday 28 July 2020, 18:52  #5
Web - Client|DOM XSS
ryzen2511
  • 7 posts

Ive done a lot of reflected and stored xss on other sites like portswiggers web academy, Im studying dom xss now. Ive tried many payloads. I dont know what to try any more. can you recommended some resources to study that will help me solve this challenge?

Tuesday 28 July 2020, 23:36  #6
Web - Client|DOM XSS
ryzen2511
  • 7 posts

Are restricted to only using 170 characters?

Wednesday 29 July 2020, 07:17  #7
Web - Client|DOM XSS
ryzen2511
  • 7 posts

I can get it to open the win page but i cant make it open my requestbin because its too much characters, the server truncates my payload :- 😡  😐  😕 . So frustrating, any hints would help. ty

Wednesday 29 July 2020, 09:13  #8
Web - Client|DOM XSS
ryzen2511
  • 7 posts

About how long do we have to wait for bot to interact with payload?

Wednesday 29 July 2020, 23:42  #9
Web - Client|DOM XSS
ryzen2511
  • 7 posts

Do I have to use the contact page or is everything done from the game page.