I am going to focus my attention on Google’s Gruyere for the rest of the semester. I continued with the XXS section and started with stored XXS via a HTML attribute. Stored XSS is any hacker script being run on a later page by it being saved and accessed later. In this exercise it has you try to use stored XSS by exploiting the profile color input box.

After going through the HTML source code in the profile page I found that the color is rendered as style='color:color'. Seeing this I knew I had to break out of the style statement by adding a ‘ in front of my script in the text field.

 I went back to the source code to see how my script was stored after placing the script in the textbox.

My script was altered because the html page runs a python script that removes all javascript tags within user input divs to keep XXS from happening. After several different attempts I finally found a script call that worked after looking into the second hint that google provides.

As I move through these exercises I keep finding different aspects of web programming I already know being used in weird ways to break a web app.