title: Cross Site Scripting Attack, troubles
body: <p>I'm preparing for my final exam for a class and am attempting to rework homework problems. This is one of them that I got zero credit for the first time around.</p>
  
  <p>The goal of this exercise was to create a URL that would point to the page with the HTML below, and instead of showing the collaboration policy intended, it would show my own, user created collaboration policy.</p>
  
  <p><strong>Attempted the following without success...</strong></p>
  
  <p>Escaped this</p>
  
  <pre><code>&lt;script&gt;document.getElementById('collab').firstChild = 'test';&lt;/script&gt; 
  </code></pre>
  
  <p>using this website
  <a href="http://www.xs4all.nl/~jlpoutre/BoT/Javascript/Utils/endecode.html" rel="nofollow">http://www.xs4all.nl/~jlpoutre/BoT/Javascript/Utils/endecode.html</a></p>
  
  <p>and added it like this... 
  www.cs.edu/vulnerable.html/?[insert escaped script here] and it didn't work. Any ideas on where I'm going wrong here?</p>
  
  <p><strong>Here is the HTML code (vulnerable.html) for the page we are suppose to exploit.</strong></p>
  
  <pre><code>&lt;html&gt;&lt;head&gt;
  &lt;script&gt;
  function loaded() {
    var parsed = document.location.href.match(/\?(.*)/);
    if (parsed &amp;&amp; parsed[1])
      eval(unescape(parsed[1]));
  }
  &lt;/script&gt;
  &lt;title&gt;Example Page Title&lt;/title&gt;&lt;/head&gt;
  &lt;body onload="loaded()" bgcolor="#ffffff"&gt;
  &lt;font face="Arial,Arial,Helvetica"&gt;
  
  &lt;table border=0 cellspacing=4 cellpadding=4&gt;
  &lt;tr&gt;
  &lt;td valign=top width="20%" bgcolor="#ffff66"&gt;
  &amp;nbsp;&lt;p&gt;
  &amp;nbsp;&lt;p&gt;
  &amp;nbsp;&lt;p&gt;
  &lt;a href="home.html"&gt;
  Home&lt;/a&gt; &lt;p&gt;
  
  Course description &lt;p&gt;
  &lt;a href="notes.html"&gt;
  Lecture notes&lt;/a&gt; &lt;p&gt;
  &lt;a href="assign.html"&gt;
  Assignments&lt;/a&gt; &lt;p&gt;
  &lt;a href="ref.html"&gt;
  Reference&lt;/a&gt; &lt;p&gt;
  &amp;nbsp;&lt;p&gt;
  &amp;nbsp;&lt;p&gt;
  &amp;nbsp;&lt;p&gt;
  
  &lt;/td&gt;
  
  &lt;td valign=top width=800&gt;
  
  &lt;h2 align=center&gt;
  Example course title
  &lt;/h2&gt;
  &lt;p&gt;
  &lt;h3 align=center&gt;Fall 2010&lt;/h3&gt;
  &lt;p&gt;
  
  
  &lt;h2&gt;Syllabus&lt;/h2&gt;
  
  Syllabus here...
  
  &lt;h2&gt;Collaboration policy&lt;/h2&gt;
  
  &lt;P id="collab"&gt;
  All assignments are strictly individual.  No collaboration
  is permitted.
  
  
  
  &lt;/td&gt;
  &lt;/tr&gt;
  &lt;/table&gt;
  
  &lt;/font&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>