Skip to content

Commit

Permalink
Remove redundant tier 1-4 prefixes from XSS challenge descriptions
Browse files Browse the repository at this point in the history
  • Loading branch information
bkimminich committed Aug 17, 2017
1 parent d6db58b commit 5f39aad
Showing 1 changed file with 8 additions and 8 deletions.
16 changes: 8 additions & 8 deletions data/datacreator.js
Original file line number Diff line number Diff line change
Expand Up @@ -86,43 +86,43 @@ function createChallenges () {
models.Challenge.create({
name: 'XSS Tier 1',
category: 'XSS',
description: 'XSS Tier 1: Perform a <i>reflected</i> XSS attack with <code>&lt;script&gt;alert("XSS1")&lt;/script&gt;</code>.',
description: 'Perform a <i>reflected</i> XSS attack with <code>&lt;script&gt;alert("XSS1")&lt;/script&gt;</code>.',
difficulty: 1,
hint: addHint('Look for an input field where its content appears in the response HTML when its form is submitted.'),
hintUrl: addHint('https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html#xss-tier-1-perform-a-reflected-xss-attack'),
hintUrl: addHint('https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html#perform-a-reflected-xss-attack'),
solved: false
}).success(function (challenge) {
challenges.localXssChallenge = challenge
})
models.Challenge.create({
name: 'XSS Tier 2',
category: 'XSS',
description: 'XSS Tier 2: Perform a <i>persisted</i> XSS attack with <code>&lt;script&gt;alert("XSS2")&lt;/script&gt;</code> bypassing a <i>client-side</i> security mechanism.',
description: 'Perform a <i>persisted</i> XSS attack with <code>&lt;script&gt;alert("XSS2")&lt;/script&gt;</code> bypassing a <i>client-side</i> security mechanism.',
difficulty: 3,
hint: addHint('Only some input fields validate their input. Even less of these are persisted in a way where their content is shown on another screen.'),
hintUrl: addHint('https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html#xss-tier-2-perform-a-persisted-xss-attack-bypassing-a-client-side-security-mechanism'),
hintUrl: addHint('https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html#perform-a-persisted-xss-attack-bypassing-a-client-side-security-mechanism'),
solved: false
}).success(function (challenge) {
challenges.persistedXssChallengeUser = challenge
})
models.Challenge.create({
name: 'XSS Tier 4',
category: 'XSS',
description: 'XSS Tier 4: Perform a <i>persisted</i> XSS attack with <code>&lt;script&gt;alert("XSS4")&lt;/script&gt;</code> bypassing a <i>server-side</i> security mechanism.',
description: 'Perform a <i>persisted</i> XSS attack with <code>&lt;script&gt;alert("XSS4")&lt;/script&gt;</code> bypassing a <i>server-side</i> security mechanism.',
difficulty: 4,
hint: addHint('The "Comment" field in the "Contact Us" screen is where you want to put your focus on.'),
hintUrl: addHint('https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html#xss-tier-4-perform-a-persisted-xss-attack-bypassing-a-server-side-security-mechanism'),
hintUrl: addHint('https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html#perform-a-persisted-xss-attack-bypassing-a-server-side-security-mechanism'),
solved: false
}).success(function (challenge) {
challenges.persistedXssChallengeFeedback = challenge
})
models.Challenge.create({
name: 'XSS Tier 3',
category: 'XSS',
description: 'XSS Tier 3: Perform a <i>persisted</i> XSS attack with <code>&lt;script&gt;alert("XSS3")&lt;/script&gt;</code> without using the frontend application at all.',
description: 'Perform a <i>persisted</i> XSS attack with <code>&lt;script&gt;alert("XSS3")&lt;/script&gt;</code> without using the frontend application at all.',
difficulty: 3,
hint: addHint('You need to work with the server-side API directly. Try different HTTP verbs on different entities exposed through the API.'),
hintUrl: addHint('https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html#xss-tier-3-perform-a-persisted-xss-attack-without-using-the-frontend-application-at-all'),
hintUrl: addHint('https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html#perform-a-persisted-xss-attack-without-using-the-frontend-application-at-all'),
solved: false
}).success(function (challenge) {
challenges.restfulXssChallenge = challenge
Expand Down

0 comments on commit 5f39aad

Please sign in to comment.