About

An exciting social media app, leveraging technology from the 90s to deliver a fun, innovative and secure profiles. Well, maybe not secure...

Guidance

This exercise is around using bits of Javascript to exploit the many cross site scripting (XSS) vulnerabilities in this site.

You can start by playing about with inserting basic HTML formatting like <b> into your profile. Then try and get an alert to pop up using <script>alert(1)</script>.

You'll need to be think harder to perform other attacks. Consider how HTML & javascript works when you mouse over an image or what overrides could be in place for clicking a link?

Here's some implementation details:

• There is some sanitisation against SQL injection but not what I'd usually do as I needed to allow XSS attacks.
• Each user's details are kept in a session.
• Your session name is: 69fddbea3afe9
• You can choose to publish your profile, which saves it for others to try accessing.
• Data will occassionally get scrubbed.
• I've created a spoofing site here.

DISCLAIMER!

I ask that people don't perform abusive attacks but someone may have done so. Be careful about what you do when clicking links. Consider using your browser's private mode.

Challenges

Here are some challenges that you might want to try:

1. Create a profile that displays an alert when someone clicks on it.
2. Show an alert when someone mouses over your profile image.
3. Show an alert when someone clicks on your favourite site.
4. Have someone get redirected to a different site when accessing your profile.
5. Have someone get redirected to a different site when clicking your favourite site.
6. If someone is completing it at the same time, can you pair and both access the same profile?