Not getting the request

The level is offline! @flabbyrabbit usually fixes it quickly, but I guess you have to move to another level for now!

Ok, can you let me know when it’s fixed?
Thanks!

I don’t know if it will be working today, but you can see if it is working in the real6 page . And check now and then if it says ‘ Level online’. It is currently ‘Level offline’

Ohh sorry, didn’t noticed that :|
Thanks!

No problem, that feature is actually recent, so it is normal to miss it ;)

Hmm… My injection works perfectly and still I have the same problem. The level is marked as being online.
Can any of you guys tell me why the script is not executed at all? It’s been more than a week since I’ve submitted it.

I’m, like some others, trying to attack without setting up a separate website, yet it seems nonsense not to have the XSS triggered, given this is not a fully simulated level that would look for a specific pattern.

Could someone contact me for a discussion?

Thx

It is still an automated check that is used, so don’t expect every method to work. Also, doing it without a separate website requires some assumptions on how things are implemented.

There were two such assumptions, one of which is less likely to work out, and the other - which plays a role in indicating execution (concerned with covering tracks) - should pretty much be fine, at least based on some comments in other threads.

If the JS is evaluated properly by the script, at least the execution-part should theoretically work.

I’m already chatting with Mugiwara27 about the issue, but I could send you my attempt at this one if you like.

As I told you in private message, your injection is too long ! You have to do a simple one
And I think you didn’t understand a main thing on the level works

I think you might have misunderstood the script I’ve sent you. I got back to you with some clarification on that.

It’s pretty clear that a script periodically checks the page. What way less clear is what it might be doing with the page, since it seems not to be running the injected script.

Whatever it is, it sounds way to complicated. The simpler it is, the more likely it will work here.