PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

DOJO CHALLENGE #5 Winners!

yeswehack.com | vulnerability | #ctf | #xss | #dojo | #yeswehack | #payload | #write-up
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

DOJO Challenge #5 was a hardcore variant of #3: trigger an XSS payload using a severely restricted character set that banned parentheses, numbers and dots; lists winners and best write-up.
Published
Collected

Related coverage

blog · yeswehack.com
Dojo challenge #54 Highscore solution
Dojo Solution - Hacker Club: Filter bypass and JSON injection to achieve improper access
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
vulnerability · yeswehack.com
DOJO CHALLENGE #20 Winners!
Winners of DOJO Challenge #20 'Butters Adventure', which required exploiting a DOM-based XSS via the $cmd parameter. Best write-ups: Tihmz, bosstester and Braxoia.
vulnerability · yeswehack.com
DOJO Challenge #23 Winners!
Winners and best write-ups from DOJO Challenge #23 '5Ways2XSS', where players had to craft a single payload that exploited five XSS-vulnerable input sections at once.
vulnerability · yeswehack.com
DOJO Challenge #22 Winners!
Winners of DOJO Challenge #22 'Butters Adventure v2', where players used a DOM clobbering technique to overwrite JavaScript's getElementById() function. Top write-ups: Scttpr, CharlB, hamzaavvan.
vulnerability · yeswehack.com
DOJO CHALLENGE #21 Winners!
Winners of DOJO Challenge #21 'EvilTwin-Admin', where players exploited a SQL logic flaw to register an admin account, a Broken Access Control case (CWE-284). Top write-ups: Floczii, W00dy, clhack.
Back