Chaining Script Gadgets to Full XSS - All The Little Things 2/2 (web) Google CTF 2020

LiveOverflow · Beginner ·📰 AI News & Updates ·5y ago

In the second part we are building on top of what we have learned. We figure out how to craft something special out of a very limited script gadget. Eventually we can use it to leak the secret notes ID and notes content. Part 1: https://www.youtube.com/watch?v=dZXaQKEE3A8 Challenge: https://capturetheflag.withgoogle.com/challenges/web-littlethings Pasteurize: https://www.youtube.com/watch?v=Tw7ucd2lKBk 00:00 - Recap Part 1 00:20 - Start of the Attack Chain 00:54 - Control the Theme Callback 02:29 - Prior JSONP Capability Research 04:40 - innerHTML Breakthrough 06:13 - Content Security Policy Fail 07:19 - iframe CSP Bypass 08:31 - The Solution 10:09 - Chaining Three Gadgets 11:34 - Researching Cool XSS Techniques 12:00 - Solving the Challenge 13:25 - Outro -=[ ❤️ Support ]=- → per Video: https://www.patreon.com/join/liveoverflow → per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join -=[ 🐕 Social ]=- → Twitter: https://twitter.com/LiveOverflow/ → Website: https://liveoverflow.com/ → Subreddit: https://www.reddit.com/r/LiveOverflow/ → Facebook: https://www.facebook.com/LiveOverflow/

Watch on YouTube ↗ (saves to browser)

Sign in to unlock AI tutor explanation · ⚡30

Playlist

Uploads from LiveOverflow · LiveOverflow · 0 of 60

← Previous Next →

LiveOverflow - Trailer

LiveOverflow - Trailer

Introduction to Linux - Installation and the Terminal - bin 0x01

Introduction to Linux - Installation and the Terminal - bin 0x01

Writing a simple Program in C

Writing a simple Program in C

Writing a simple Program in Python - bin 0x03

Writing a simple Program in Python - bin 0x03

Live Hacking - Twitch Recording overthewire.org - Vortex 0x01-0x03 (3h)

Live Hacking - Twitch Recording overthewire.org - Vortex 0x01-0x03 (3h)

Reversing and Cracking first simple Program - bin 0x05

Reversing and Cracking first simple Program - bin 0x05

Abusing the exception handler to leak flag - 32C3CTF readme (pwnable 200)

Abusing the exception handler to leak flag - 32C3CTF readme (pwnable 200)

ROP with a very small stack - 32C3CTF teufel (pwnable 200)

ROP with a very small stack - 32C3CTF teufel (pwnable 200)

Uncrackable Programs? Key validation with Algorithm and creating a Keygen - Part 1/2 - bin 0x07

Uncrackable Programs? Key validation with Algorithm and creating a Keygen - Part 1/2 - bin 0x07

Uncrackable Program? Finding a Parser Differential in loading ELF - Part 2/2 - bin 0x08

Uncrackable Program? Finding a Parser Differential in loading ELF - Part 2/2 - bin 0x08

Syscalls, Kernel vs. User Mode and Linux Kernel Source Code - bin 0x09

Syscalls, Kernel vs. User Mode and Linux Kernel Source Code - bin 0x09

Smashing the Stack for Fun and Profit - setuid, ssh and exploit.education - bin 0x0B

Smashing the Stack for Fun and Profit - setuid, ssh and exploit.education - bin 0x0B

Live Hacking - EFF-CTF 2016 - Level 0-4 (Enigma Conference)

Live Hacking - EFF-CTF 2016 - Level 0-4 (Enigma Conference)

First Stack Buffer Overflow to modify Variable - bin 0x0C

First Stack Buffer Overflow to modify Variable - bin 0x0C

First Exploit! Buffer Overflow with Shellcode - bin 0x0E

First Exploit! Buffer Overflow with Shellcode - bin 0x0E

Buffer Overflows can Redirect Program Execution - bin 0x0D

Buffer Overflows can Redirect Program Execution - bin 0x0D

Doing ret2libc with a Buffer Overflow because of restricted return pointer - bin 0x0F

Doing ret2libc with a Buffer Overflow because of restricted return pointer - bin 0x0F

Reverse engineering C programs (64bit vs 32bit) - bin 0x10

Reverse engineering C programs (64bit vs 32bit) - bin 0x10

pwnable.kr - Levels: fd, collision, bof, flag

pwnable.kr - Levels: fd, collision, bof, flag

Reverse Engineering and identifying Bugs - BKPCTF cookbook (pwn 6) part 1

Reverse Engineering and identifying Bugs - BKPCTF cookbook (pwn 6) part 1

Leaking Heap and Libc address - BKPCTF cookbook (pwn 6) part 2

Leaking Heap and Libc address - BKPCTF cookbook (pwn 6) part 2

Arbitrary write with House of Force (heap exploit) - BKPCTF cookbook (pwn 6) part 3

Arbitrary write with House of Force (heap exploit) - BKPCTF cookbook (pwn 6) part 3

Live Hacking - Internetwache CTF 2016 - web50, web60, web80

Live Hacking - Internetwache CTF 2016 - web50, web60, web80

Live Hacking - Internetwache CTF 2016 - crypto60, crypto70, crypto90

Live Hacking - Internetwache CTF 2016 - crypto60, crypto70, crypto90

A simple Format String exploit example - bin 0x11

A simple Format String exploit example - bin 0x11

NEW VIDEOS ARE COMING - loopback 0x00

NEW VIDEOS ARE COMING - loopback 0x00

HTML + CSS + JavaScript introduction - web 0x00

HTML + CSS + JavaScript introduction - web 0x00

The HTTP Protocol: GET /test.html - web 0x01

The HTTP Protocol: GET /test.html - web 0x01

Building Poor Man's Logic Analyzer with an Arduino - Reverse Engineering A/C Remote part 1

Building Poor Man's Logic Analyzer with an Arduino - Reverse Engineering A/C Remote part 1

What is PHP and why is XSS so common there? - web 0x02

What is PHP and why is XSS so common there? - web 0x02

Introducing the AngularJS Javascript Framework - XSS with AngularJS 0x00

Introducing the AngularJS Javascript Framework - XSS with AngularJS 0x00

Sandbox Bypass in Version 1.0.8 - XSS with AngularJS 0x1

Sandbox Bypass in Version 1.0.8 - XSS with AngularJS 0x1

Capturing & Analyzing Packets with Saleae Logic Pro 8 - Reverse Engineering A/C Remote part 2

Capturing & Analyzing Packets with Saleae Logic Pro 8 - Reverse Engineering A/C Remote part 2

XSS Contexts and some Chrome XSS Auditor tricks - web 0x03

XSS Contexts and some Chrome XSS Auditor tricks - web 0x03

Previous Bypass is now fixed in version 1.4.7 - XSS with AngularJS 0x2

Previous Bypass is now fixed in version 1.4.7 - XSS with AngularJS 0x2

New Sandbox Bypass in 1.4.7 - XSS with AngularJS 0x3

New Sandbox Bypass in 1.4.7 - XSS with AngularJS 0x3

The Heap: what does malloc() do? - bin 0x14

The Heap: what does malloc() do? - bin 0x14

The Heap: How to exploit a Heap Overflow - bin 0x15

The Heap: How to exploit a Heap Overflow - bin 0x15

Reverse Engineering with Binary Ninja and gdb a key checking algorithm - TUMCTF 2016 Zwiebel part 1

Reverse Engineering with Binary Ninja and gdb a key checking algorithm - TUMCTF 2016 Zwiebel part 1

Scripting radare2 with python for dynamic analysis - TUMCTF 2016 Zwiebel part 2

Scripting radare2 with python for dynamic analysis - TUMCTF 2016 Zwiebel part 2

Live Hacking - Internetwache CTF 2016 - exp50, exp70, exp80

Live Hacking - Internetwache CTF 2016 - exp50, exp70, exp80

Sandbox bypass for the latest AngularJS version 1.5.8 - XSS with AngularJS 0x4

Sandbox bypass for the latest AngularJS version 1.5.8 - XSS with AngularJS 0x4

Channel is growing and Riscure hardware CTF starting soon - loopback 0x01

Channel is growing and Riscure hardware CTF starting soon - loopback 0x01

Explaining Dirty COW local root exploit - CVE-2016-5195

Explaining Dirty COW local root exploit - CVE-2016-5195

What is CTF? An introduction to security Capture The Flag competitions

What is CTF? An introduction to security Capture The Flag competitions

The Heap: How do use-after-free exploits work? - bin 0x16

The Heap: How do use-after-free exploits work? - bin 0x16

The Browser is a very Confused Deputy - web 0x05

The Browser is a very Confused Deputy - web 0x05

The Heap: Once upon a free() - bin 0x17

The Heap: Once upon a free() - bin 0x17

Simple reversing challenge and gaming the system - BruCON CTF part 1

Simple reversing challenge and gaming the system - BruCON CTF part 1

int0x80 from DualCore lent me his lockpicking set and I'm a horse - BruCON CTF part 2

int0x80 from DualCore lent me his lockpicking set and I'm a horse - BruCON CTF part 2

The Heap: dlmalloc unlink() exploit - bin 0x18

The Heap: dlmalloc unlink() exploit - bin 0x18

MD5 Length Extension and Blind SQL Injection - BruCON CTF part 3

MD5 Length Extension and Blind SQL Injection - BruCON CTF part 3

TCP Protocol introduction - bin 0x1A

TCP Protocol introduction - bin 0x1A

Socket programming in python and Integer Overflow - bin 0x1B

Socket programming in python and Integer Overflow - bin 0x1B

Linux signals and core dumps - bin 0x1C

Linux signals and core dumps - bin 0x1C

[Live] Remote oldschool dlmalloc Heap exploit - bin 0x1F

[Live] Remote oldschool dlmalloc Heap exploit - bin 0x1F

Riscure Embedded Hardware CTF setup and introduction - rhme2 Soldering

Riscure Embedded Hardware CTF setup and introduction - rhme2 Soldering

Rooting a CTF server to get all the flags with Dirty COW - CVE-2016-5195

Rooting a CTF server to get all the flags with Dirty COW - CVE-2016-5195

How to learn hacking? ft. Rubber Ducky

How to learn hacking? ft. Rubber Ducky

Format String to dump binary and gain RCE - 33c3ctf ESPR (pwn 150)

Format String to dump binary and gain RCE - 33c3ctf ESPR (pwn 150)

Related AI Lessons

Day 15: The Ripple Effect — Why You Should Start “Building in Public” Today

Learn how building in public can help you achieve AI mastery by sharing your journey and progress with others

When the Instrument Changes

Learn to adapt and compose differently when old patterns no longer fit, a crucial skill in AI and professional growth

How Artificial Intelligence Is Quietly Reshaping the Way We Work — and What to Do About It

Learn how AI is transforming industries and what skills professionals need to adapt, with actionable steps to enhance your career in an AI-driven workforce

Medium · Machine Learning

Top-Rated AI Development Companies in 2026 for Custom Business Solutions

Discover top-rated AI development companies for custom business solutions and learn how to approach AI development effectively

Chapters (12)

Recap Part 1

0:20 Start of the Attack Chain

0:54 Control the Theme Callback

2:29 Prior JSONP Capability Research

4:40 innerHTML Breakthrough

6:13 Content Security Policy Fail

7:19 iframe CSP Bypass

8:31 The Solution

10:09 Chaining Three Gadgets

11:34 Researching Cool XSS Techniques

12:00 Solving the Challenge

13:25 Outro

OpenAI Spud (GPT 6), Claude Conway, GPT Image 2, Cursor 3, Claude Code Ultra, & More! AI NEWS!