Hacker News new | ask | show | jobs
by honoredb 4409 days ago
Fun! Level 6 failed to load any widgets, evil or otherwise, in Chrome; I had to switch to Firefox and redo the whole test. For my external script I used http://pastebin.com/raw.php?i=15S5qZs0, although I don't think the lack of a .js extension there was the problem.
5 comments

I hope this isn't a spoiler, but remember there are other ways to load resources without an external request. You can pass that stage without any requests to external servers.
Care to spoil how? I used an external server (Dropbox), but I'd love to know how to do it without.
SpoilersrandomletterssdataurlSpoilermorerandemletters
I had to manually remove the https:// in front of the URL for it to work. The following error is:

[blocked] The page at 'xss-game' was loaded over HTTPS, but ran insecure content from 'script-url': this content should also be loaded over HTTPS.

got the same problem, it only works with a https address !
Nope. Works even if you use an address without http, but beginning with only "//"
In that example "//" is just another way to say "https://", though.
I had the same issue, I think it depends on browser configuration. Some browsers disallow http content on https pages.
The regex is case sensitive. That's how I solved it.
haha so obvious yet I completely missed that! I went with a protocol-relative url [0]

[0] http://www.paulirish.com/2010/the-protocol-relative-url/

Weird. It worked fine for me in chrome.