{"id":21053511,"url":"https://github.com/etcinit/xss-challenge","last_synced_at":"2025-05-15T21:36:44.275Z","repository":{"id":23966539,"uuid":"27348975","full_name":"etcinit/xss-challenge","owner":"etcinit","description":"XSS challenge over IRC, because why not","archived":true,"fork":false,"pushed_at":"2014-11-30T21:26:21.000Z","size":848,"stargazers_count":1,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-13T23:29:52.975Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/etcinit.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-11-30T20:29:49.000Z","updated_at":"2024-01-16T01:01:31.000Z","dependencies_parsed_at":"2022-08-22T08:31:08.161Z","dependency_job_id":null,"html_url":"https://github.com/etcinit/xss-challenge","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/etcinit%2Fxss-challenge","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/etcinit%2Fxss-challenge/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/etcinit%2Fxss-challenge/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/etcinit%2Fxss-challenge/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/etcinit","download_url":"https://codeload.github.com/etcinit/xss-challenge/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254425819,"owners_count":22069239,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-19T16:07:01.406Z","updated_at":"2025-05-15T21:36:43.756Z","avatar_url":"https://github.com/etcinit.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# XSS IRC Challenge\n\nThis is a very simple CTF XSS challenge that emulates an insecure HTML/JS IRC client\nconnected to an IRC network. The goal is to inject JS into the client and\nchange the title of the web page (`document.title`) to a non-empty string.\n\nAs an additional non-productive feature, the client will send random [developer excuses](http://developerexcuses.com/)\n to the `#general` channel on the IRC server every 10 seconds.\n\n## Requirements\n\nThis challenge is built inside a Docker container so all its dependencies are already\nprovided. The only thing you need to download to get it running is the Docker\ndaemon:\n\n- Docker 1.3 (or higher)\n- Boot2docker (if you are on Windows or OSX)\n\n## Architecture\n\n![https://raw.githubusercontent.com/eduard44/xss-challenge/master/doc/Arch.png](https://raw.githubusercontent.com/eduard44/xss-challenge/master/doc/Arch.png)\n\nInside the Docker container there are two main modules, a simple IRC server and the\nvulnerable IRC client. The client by itself is not really a web browser, but when\nit starts it creates an instance of a PhantomJS headless browser, this allows it\nto create a sandbox-like environment. Whenever the client gets a private message\nfrom an IRC user, it will create an HTML page and inject the message into it.\nAfter that it checks if the page title changes after the message was injected,\nif it was it sends a private message back to the user with the flag.\nIn order to prevent any concurrency issues the client uses an internal queue to\nprocess each message sequentially.\n\n## Quick setup\n\n```sh\n# Start the server\ndocker run -p 6667:6667 -it eduard44/xss-challenge\n```\n\nAfter the server has started, you should be able to connect with your own IRC client to `localhost:6667`\n(or the Boot2Docker VM IP address)\n\n## Building from source\n\n```sh\n# Change the current work dir to the git repo\ncd xss-challenge\n\n# Build the docker image (this might take a while)\ndocker build -t .\n\n# Start the server\ndocker run -p 6667:6667 -it xss\n```\n\nAfter the server has started, you should be able to connect with your own IRC client to `localhost:6667`\n(or the Boot2Docker VM IP address)\n\n## Using a custom flag\n\nIf the `FLAG` environment variable is set, the client\nwill use that instead of the default flag. You can set it when running the container:\n\n```\ndocker run -p 6667:6667 -e \"FLAG=ThisIsASampleFlag\" -it xss\n```\n\n## Running without Docker\n\nIt is also possible to use the client without Docker, however, you will need to\nhave Node.js and NPM installed and have an IRC server to which the client can connect to.\nThe setup process is very simple:\n\n```sh\n# Change the current work dir to the git repo\ncd xss-challenge\n\n# Install dependencies\nnpm install\n\n# Start the client\nnode index\n```\n\nYou can use the environment variables below to configure the client without modifying it\n\n## Environment Variables\n\n- `HOST`: Hostname of the IRC server to connect to (default: `localhost`)\n- `NICK`: Nickname of the IRC client\n- `FLAG`: Flag to hand out once code injection is detected\n\n## Example CTF formulation\n\nFor an example CTF problem formulation and hints, check [CTF.md](https://github.com/eduard44/xss-challenge/blob/master/CTF.md)\n\n## Example solution\n\nCheck [SOLUTION.md](https://github.com/eduard44/xss-challenge/blob/master/SOLUTION.md) (Spoiler alert!)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fetcinit%2Fxss-challenge","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fetcinit%2Fxss-challenge","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fetcinit%2Fxss-challenge/lists"}