diff --git a/2020-04-27-quiz-your-friends-xss.md b/2020-04-27-quiz-your-friends-xss.md new file mode 100644 index 0000000..b06f20c --- /dev/null +++ b/2020-04-27-quiz-your-friends-xss.md @@ -0,0 +1,81 @@ +--- +title: "The \"Quiz Your Friends\" XSS Exploit" +layout: post +--- + +## TODO write intro + +## How I Found This Exploit + +While filling in one of my friend's surveys I thought it would be +funny for them to know it is me without anyone else knowing. +We were young and had `Inspect Element`ed a few things together, +so it was a safe bet that an HTML joke would let them know. + +So I typed in my name like so: + +`BOLD_STEVE.JPG` + +Now in theory this should have shown in in the leaderboard as: "<b>Bold Steve</b>" +However, to my horror and excitement, I saw this in the leaderboard: + +`BOLD_STEVE_LEADERBOARD.JPG` + +The text "Bold Steve" showed up **in bold** on the leaderboard. +This told me all I needed to know. To add a `