HTML5 Escape Game

Using various browser APIs, your goal is to get root of the local box.
You can try to get a filesystem browser with printer popup or download popup 'save as'.
There are various informations on your jail (local IPs, browser version), and you can perform network scans too.
Most of the enumerations are clickable, and will autofill the corresponding inputs in all blocks.
This page is a single HTML file, with no dependencies on the ICANN IPv4 Internet, which means that you can save it to a disk drive. Beware, some features are disabled by the browsers when the source file is not served over network.
You will need an ECMAScript runtime.

I'm not very good at CSS.
2016-10-03 : WIP, adding network scan.

Local IP addresses (HTML5 WebRTC API)

• window.RTCPeerConnection
• window.webkitRTCPeerConnection
• window.mozRTCPeerConnection

http://net.ipcalf.com/

Javascript execution

eval();

Client-side « fake » download

Set these mimetypes with clicks :

mimetype
data
filename/title

• Download 1 ! window.location (no filename)
• Download 2 ! href(data:).click
• Download 3 ! subwindow.execCommand.SaveAs
• Download 4 ! window.saveAs
• Download 5 ! navigator.msSaveBlob
• Download 6 ! navigator.msSaveorOpenBlob

• window.open
• document.createEvent
• window.saveAs
• navigator.saveBlob
• navigator.msSaveBlob
• navigator.msSaveOrOpenBlob

http://stackoverflow.com/questions/4458119/display-save-as-dialog-and-save-contents-of-a-selected-text-inside-textarea-to/4458807#4458807
http://hackworthy.blogspot.fr/2012/05/savedownload-data-generated-in.html
http://stackoverflow.com/questions/2897619/using-html5-javascript-to-generate-and-save-a-file

File input

• window.File
• window.FileReader
• window.FileList
• window.Blob

https://www.html5rocks.com/en/tutorials/file/dndfiles/

Canvas file input (drop)

• URL.createObjectURL

Editable <A> element (specific URI schemes)

• steam://yolo
• mailto:root@127.0.0.1
• callto:+33613583200
• skype:+33613583200
• abcdef:hey
• abcdef://hey
• javascript:alert("hey")
• ftp://192.168.0.1/
• ftps://192.168.0.1/
• ssh://192.168.0.1/
• file://192.168.0.1/
• file:///192.168.0.1/
• file:///C/Windows.192.168.0.1/
• file:///C:\WINDOWS\Media\onestop.mid
• file:\\C:\WINDOWS\Media\onestop.mid
• file://etc/passwd
• file:///etc/passwd
• \\192.168.0.1\
• chrome://chrome-urls/
• chrome://settings/passwords

javascript:alert('wtf')

Target IFRAMES

add frame

Browser footprint

http://www.browserleaks.com/javascript

System print popup

print();

Network scan

Target
Protocol
Port
Added /
URI suffix

http://www.andlabs.org/tools/jsrecon/jsrecon.html