Level 5 - Breaking protocol

Hints

1. The title of this level is a hint.

2. It is useful look at the source of the signup frame and see how the URL parameter is used.

3. If you want to make clicking a link execute Javascript (without using the onclick handler), how can you do it?

4. If you're really stuck, take a look at this IETF draft

Exploitation

Open the frame in a different tab using the following URI: https://xss-game.appspot.com/level5/frame/

Click on the Sign up link.

Payload

Change the next parameter to the following:

?next=javascript:alert(1);

Click on the Next button.