Cure53 XSSMas Challenge, initiated in 2013, is a recurring hacking event, where those challenged have to solve a complex security puzzle in order to win money and fame, attempting to hack a web site in any means necessary.
'Any means', does not preclude rules of engagement. For example the 2015 challenge required hacking without user interaction, i.e setting a XSS trap and waiting for it to be activated as in the case of blind XSS.
So as not to spoil your fun with this year's challenge, which has been posted today, here we'll look back to last year's challenge required hackers to begin with index.php and progressively break through index3.php in order to obtain the price.
What was actually required is nicely summed up in:
Find a way to bypass the XSS filters of all browsers by realizing, the string <script> is being stripped
Find a way to execute the injected script on index.php without user interaction
Then steal the token from token.php to get to index2.php
There you would have to either bypass the AngularJS sandbox or create a very long submission with the implicit bypass we created for you
Or be smart and realize, that you can bypass index2.php completely by messing with the referrer
Then to enter index3.php and create XSS without user interaction again, despite the much harder conditions here
The solution that cracked it first is summed up in the next 154 bytes of 'obfuscated' code:
Cure53 posts the complete samples, walk-throughs, solutions and lessons learned on their GitHub page, which apart from impressing also makes for very educational reading.
For example the lessons learned from last year's challenge were:
XSS without user interaction is still possible in most modern browsers.
XSS filters just need a bit of replacement done by a website to be universally bypassed.
ES6 is a great tool to optimize exploits.
CSS and XSS go very well together and finally...
Don't rely on flaky referrer based XSS protection.We built in this bug on purpose but we've seen many cases where this was not the case.
Challenges like this one don't offer much money-wise, last time an overall of 2.500,00 EUR was paid out to the winners, but are extremely valuable additions to a hacker's toolset, where XSSHunter and Hacksplaining should already be occupying a place. They are stepping stones in your professional career that prepare you for even bigger challenges such as those commissioned by bug bounty services like HackerOne where big names pay for discovering security vulnerabilities in their products.
That aside, act as means of funnelling the hacking creativity towards ethical and rewarding causes instead of letting the restless minds trying to satisfy their curiosity through other, less ethical and nefarious ways.