[1llusion]

Hi!

Since HC XSS challenge got deleted. ( Suspecting abuse of the challenge )
Anyway I've decided to release it.

!!!NOTE!!! Feel free to upload the XSS challenge on your website. The challenge doesn't need any 3rd party software nor it uses any framework, therefore it is VERY safe. The XSS vulnerabilities are protected against misuse by unique tokens and all users have to agree on the ToS before they can start it. There is absolutely NO CHANCE at all, that the challenge could lead to shell upload OR any kind of system compromise. After all, XSS attacks client, not server

How to use: Upload files to some host. And... that is it no need for any settings Or you can host it locally too

Feel free to edit the files etc.

XSS challenge 1-5 + index.php
https://dl.dropbox.com/u/46190297/misc/X...ip.torrent

NOTE: The file is a torrent on purpose. The challenge should help spread the knowledge and torrents are symbol of information sharing. This torrent IS 100% LEGAL (unless your country disallows torrents in general). So help to spread the knowledge and seed

[Dawnc0re]

YAY!!!
Thanks For This 1llusion

[bluedog.tar.gz]

It was deleted because of suspecting abuse of the challenge.
May get re-added later but feel free to use it yourself to.

[StormHasHe]

Thanks a lot guys!

But, what about the challenges 6-8? are they included?? I was working on 8 =D

[1llusion]

Thanks a lot guys!

But, what about the challenges 6-8? are they included?? I was working on 8 =D

I'll include them later

[StormHasHe]

Btw, can you tell me if my solution to 7 was correct? I'm still not sure about it.

Thanks!

[Anima Templi]

Btw, can you tell me if my solution to 7 was correct? I'm still not sure about it.

Thanks!

How could you be unsure about that? I mean, you should have seen a pop-up/ alert box?

[StormHasHe]

Btw, can you tell me if my solution to 7 was correct? I'm still not sure about it.

Thanks!

How could you be unsure about that? I mean, you should have seen a pop-up/ alert box?

Edit: I'll just explain my doubt here, maybe its faster:

My doubt is because I used another field to inject the javascript, not the intended one, but a hidden input or something like, so i'm not sure if this was the right approach in the context of the challenge.

My answer to 7 is there at the original topic about the challenge, if you would check it out =)

thanks!

[1llusion]

Btw, can you tell me if my solution to 7 was correct? I'm still not sure about it.

Thanks!

Yeh its correct

[StormHasHe]

Cool, thanks a lot mate! =D