Table of contents
Level 1
No defensive detection:
Directly construct the url: http://192.168.8.150:88/level1.php?name= <script>alert(1)</script>
Play through
Level 2
First, I tried the same method as the first level and found that I couldn't pass it.
Check the page source code and find that <> is escaped, but it is not escaped at the value. Try to use the value as the output point.
Close the < on the left and then inject
"> <script>alert(1)</script>
Level 3
First, I tried the same method as the previous level and found that I couldn't pass it.
Checking the source code of the page, I found that all < and > were escaped in the source code this time. But single quotes as closing characters are not encoded.
So we are advanced and closed, write an on event 'onclick='alert(1) to bypass, this event is to put the mouse on the input window to trigger the event, that is, the injection is successfully bypassed.
Level 4
Enter the test statement <SCRscriptIPT>'"()Oonnjavascript; Check the source code of the page and find that it filters out <>, but there are both single quotes and double quotes, and the double quotes are still closed symbols.
We still use the on function to bypass, but the single quotes are replaced by double quotes.
"οnclick="alert(1)
Level 5
Enter the test statement <SCRscriptIPT>'"()Oonnjavascript;
Check the page source code and find that On is filtered, indicating that the time cannot be built and case conversion cannot be used.
Make a pseudo-protocol to trigger (hyperlink): "><a href ="javascript:alert(1)">click me </a>
Click to complete the level.
Level 6
Enter the test statement <SCRscriptIPT>'"()Oonnjavascript;
Check the page source code and find that the filtered results are the same as those of the previous level.
We can try the payload from the previous level and find that it cannot be clicked. Then take a closer look at the source code.
Here we find that the href is filtered, we can try to convert the href to upper and lower cases.
Make a pseudo-protocol to trigger (hyperlink): "><a hREf ="javascript:alert(/pig/)">click me </a>
Click through levels
Level 7
Enter the test statement <SCRscriptIPT>'"()Oonnjavascript;
Checking the page source code, we found that there is only one script and one on left. Here we consider using double writing to bypass it.
Double write bypass:"><SCRscriptIPT>alert(/pig/)</SCRscriptIPT>
Complete the level
