Add writeups for prompt.ml levels -2 to -4 about xsschallengewiki

[cure53]

I am not sure if the author is ready for the solutions to be public.

@filedescriptor What do you think?

[filedescriptor]

I am totally okay with that.

[cure53]

@filedescriptor Cool :)

@gsingh93 Pull requests are welcome!

[cure53]

@filedescriptor As far as I know, this has been fixed in Chromium for some months by now. Should we document the solution from back then?

[filedescriptor]

No objection!

[cure53]

IIRC it was )},prompt(1)}{{// correct?

[filedescriptor]

)},{0:prompt(1 worked. But I'm not sure if yours worked as well.

[cure53]

Mine worked in a local set-up on Chrome 25. Not sure, what Chrome version it worked in last - and the vectors changed over time due to different with blocks in the browser code.

[filedescriptor]

I think we can mention either one - because we focus more on the peculiar instead of the actual implementation.

[cure53]

Here is a draft version for sanity check:

https://github.com/cure53/XSSChallengeWiki/wiki/prompt.ml#hidden-level--4

[filedescriptor]

lgtm!

[cure53]

Should we add -2 and -3 as well?

[filedescriptor]

Sure

[cure53]

Do you still have the solutions at hand? :) Then I can take care.

[filedescriptor]

-2: @if(0)@end (@cc_on is not necessary)
-3: semi-colon instead of ampersand

[cure53]

I know - I recall what the way of solving it was, but I didn't wanna spent time on both re-finding the exact solution and doing the write-up - thus asking for the solutions in case you still have them - not just the general way :)

Also not in a hurry here, if you still have the string I'll use it, if not, I'll re-solve :P

[filedescriptor]

Ah sorry about that. I don't have the original solutions but I've just tried to recall them:
-2: "><script>@if(0)#@end;prompt(1)@if(0)#@end</script>
For -3, I am not sure if the API has changed but I can't seem to reproduce anymore

[cure53]

Thanks :D And same here for "-3", just tried as well.

[cure53]

I think it was ;callback=prompt(1, - possible?

[filedescriptor]

I think it should be something like "onclick=prompt(1) id="a";callback=a.click;
because the callback name is validated. We first create a click event handler, and set the callback to reference to its click function to invoke the payload.

[cure53]

Ah, fair enough. I will use that. Thx :)

[filedescriptor]

Let me know if you need helps :) By the way I think you can also mention that -3 is a scenario for SOME

[cure53]

Technically not SOME but COME and that sounds very non-beneficial...

[cure53]

Ready for a sanity check!

[filedescriptor]

Looks perfect! Finally the write-up is complete, thanks mario :D

[cure53]

Thank you :)