Level 4 and level 6 of the Stripe CTF had solutions around XSS.
> Registered Users
<%= user[:username] %>
(password: <%= user[:password] %>, last active <%= last_active %>)
The level 4 web application lets you transfer karma to another user and in doing so you are also forced to expose your password to that user. The main user page displays a list of users who have transfered karma to you along with their password. The password is not HTML encoded so we can inject HTML into that user's browser. For instance, we could create an account with the following HTML as the password which will result in XSS with that HTML:
Code review red flags in this case included lack of encoding when using user controlled content to create HTML content, storing passwords in plain text in the database, and displaying passwords generally. By design the web app shows users passwords which is a very bad idea.
...
def self.safe_insert(table, key_values)
key_values.each do |key, value|
# Just in case people try to exfiltrate
# level07-password-holder's password
if value.kind_of?(String) &&
(value.include?('"') || value.include?("'"))
raise "Value has unsafe characters"
end
end
conn[table].insert(key_values)
endThis web app does a much better job than the level 4 app with HTML injection. They use encoding whenever creating HTML using user controlled data, however they don't use encoding when injecting JSON data into script (see post_data initialization above). This JSON data is the last five most recent messages sent on the app so we get to inject script directly. However, the system also ensures that no strings we write contains single or double quotes so we can't get out of the string in the JSON data directly. As it turns out, HTML lets you jump out of a script block using no matter where you are in script. For instance, in the middle of a value in some JSON data we can jump out of script. But we still want to run script, so we can jump right back in. So the frame so far for the message we're going to post is the following:
Netflix lets you watch a subset of their movies online via their website and a subset of those movies are available to watch on the Xbox 360's Netflix app. so its not always easy to find movies to watch on Xbox 360. Yet, I regularly see my Xbox friends using the Netflix app and its a shame they didn't make an easy way to share movie recommendations with your friends. Instead we must share movie recommendations the old fashioned way. Here's the movies I've found and enjoyed on my 360.
The weekend before last I saw Dark Knight with some friends from work and then we all ate at Z'Tejas after. Like everyone has said and as the name implies Dark Knight is... dark. Dark Knight was a little over the top at times as compared to Batman Begins but I really enjoyed it. Two times during the movie I thought it had ended but I was wrong. The Joker is both frightening (Cringe inducing line "Wanna know how I got these scars?") and humorous ("Where is Harvey Dent? ... You know where Harvey is? You know who he is?", as well as the pencil magic trick). I can certainly recommend it to anyone who enjoyed Batman Begins. The previews included Burn After Reading a new Coen Brother's comedy that I look forward to, and Quantum of Solace which hopefully does the same thing Dark Knight has, keep up the new direction on the refreshed franchise.
This past
weekend Sarah and I went to a Mariners baseball game. I think this is the first MLB baseball game I've seen in person. Sarah's company gave out tickets for the game and the use of a suite. Its a
room half way up the stadium with comfortable chairs, a mini-fridge built-in to the marble counter-topped center table, and a big flat screen television with the game on it. I suppose that's in
case you don't want to turn to the right and sit at the window, or walk out onto the balcony which features three rows of comfy chairs overlooking the field. Anyway there was free food and drinks
and I met some of the people Sarah works with.
The move of my website to NearlyFreeSpeech.NET is mostly complete except for a few server side things not working yet: RandomGrammar and parts of Vizicious. I'm still very happy with the NearlyFreeSpeech.NET hosting and so far I've only spent a few cents on hosting. At this rate I'll only spend a few dollars a year.
I've moved all my pages to use the same CSS and hooked it up with cookies to my Kuler color options so now changes to the color theme will stick and apply to all my pages. I haven't figured out the caching for this yet so you may have to refresh to see changes to color applied.
Some rights reserved