26 lines
3.0 KiB
Properties
26 lines
3.0 KiB
Properties
# XSS success, failure messages and hints
|
|
xss.title=Cross Site Scripting
|
|
xss-stored.title=Cross Site Scripting (stored)
|
|
xss-mitigation.title=Cross Site Scripting (mitigation)
|
|
xss-reflected-5a-success=Well done, but alerts aren't very impressive are they? Please continue.
|
|
xss-reflected-5a-failure=Try again. We do want to see this specific javascript (in case you are trying to do something more fancy).
|
|
xss-reflected-5a-hint-1=Think about how the inputs are presumably processed by the application.
|
|
xss-reflected-5a-hint-2=Quantity inputs are probably processed as integer values. Not the best option for inputting text right?
|
|
xss-reflected-5a-hint-3=What information send to the application gets reflected back after being submitted?
|
|
xss-reflected-5a-hint-4=Just try purchasing something. You want your script to be included in the purchase-confirmation.
|
|
xss-reflected-5b-success=Correct ... because <ul><li>The script was not triggered by the URL/QueryString</li><li>Even if you use the attack URL in a new tab, it won't execute (becuase of response type). Try it if you like.</li></ul>
|
|
xss-reflected-5b-failure=Nope, pretty easy to guess now though.
|
|
xss-reflected-6a-success=Correct! Now, see if you can send in an exploit to that route in the next assignment.
|
|
xss-reflected-6a-failure=Sorry that's not correct. Look at the example again to understand what a valid route looks like. If you're stuck... hints might help.
|
|
xss-reflected-6a-hint-1=To search through the client side code, use the developer tools of your browser. (If you don't know how to use them, check the <i>Developer Tools</i> Lesson in the general category.)
|
|
xss-reflected-6a-hint-2=Since you are looking for application code, check the WebGoat/js/goatApp folder for a file that could handle the routes.
|
|
xss-reflected-6a-hint-3=Make sure you add the base route at the start, when submitting your solution.
|
|
xss-reflected-6a-hint-4=Still didn't find it? Check the <a href="/WebGoat/js/goatApp/view/GoatRouter.js" target="_blank">GoatRouter.js</a> file. It should be pretty easy to determine.
|
|
xss.lesson1.failure=Are you sure? Try using a tab from a different site.
|
|
xss-dom-message-success=Correct, I hope you didn't cheat, using the console!
|
|
xss-dom-message-failure=Incorrect, keep trying. It should be obvious in the log when you are successful.
|
|
xss-stored-comment-success=It appears your payload should invoke the function. To tell for sure, you need to capture the value and put it in the form below. Then we will really know.
|
|
xss-stored-comment-failure=We can't see the payload in your submission, but XSS can be tricky. Look for the call back fired after the comments reload. If you see that and can put the correct value there and put it in, maybe you did succeed.
|
|
xss-stored-callback-success=Yes, that is the correct value (note, it will be a different value each time the phoneHome endpoint is called).
|
|
xss-stored-callback-failure=No, that is not the correct value (note, it will be a different value each time the phoneHome endpoint is called).
|