Rook to XSS: How I hacked chess.com with a rookie exploit
A write-up on exploiting chess.com’s web security prompts both admiration for the young researcher’s sophisticated XSS and on-site request forgery techniques and concern over how subtle input-validation and domain-parsing bugs can undermine large platforms. Commenters compare the case to earlier MySpace-era HTML injection issues, delve into how naive same-origin and URL checks fail, and note browser safeguards like Chrome’s phishing warnings against deceptive subdomains. The thread widens into contrasting views on for‑profit chess.com versus non‑profit lichess.org, cheating detection, and how bug bounty work can shape early careers, including interest from major tech employers.
Exploit complexity and technical discussion
- Many were impressed that the exploit was far from “rookie”: it chained multiple weaknesses, bypassed validation, abused the rich-text editor, and used carefully crafted subdomains and redirects.
- Several comments note how hard domain parsing and HTML sanitization are, especially when implemented with regex instead of proper parsers.
- The “on-site request forgery (OSRF)” term is clarified as analogous to CSRF but within the same site.
- Explanations of the subdomain trick emphasize that chess.com’s server-side check likely used naive string matching on the hostname, not a true same-origin or proper allow-list check.
- Some discuss cookie and XSS security: the main session cookie was HttpOnly, but other sensitive data was accessible in JavaScript; advice is given to rely on well-vetted security libraries.
- Rich-text editors are seen as “holy grails” for XSS and a frequent source of subtle bugs.
Chess.com vs Lichess debate
- Many recommend Lichess, praising it as free, open-source, non-profit, fast, and with strong analysis tools and WebAssembly-based engine in the browser.
- Others prefer chess.com for UX, analysis UI, tutorials, and perceived better cheat detection and game quality.
- Complaints about Lichess include widespread cheating, many opponents aborting games, and less engaging lessons.
- Criticism of chess.com focuses on paywalled analysis features, exclusivity deals with streamers, and for-profit behavior competing with a non-profit alternative.
- A political/ideological tangent arises from Lichess branding itself humorously with left-leaning descriptors, provoking both criticism and support.
Career and bug bounty angle
- Commenters are impressed by the author’s young age and skill, suggesting strong career potential in security.
- There is discussion of referrals to large tech companies, with disagreement over the ethics of working for them.
- UK-style degree apprenticeships are discussed as a strong alternative to traditional university, especially at well-known companies.
Game integrity and cheating detection
- One user reports odd behavior on chess.com (moves being made by others when not logged in); others are confused and this remains unclear.
- A side thread explores cheat detection: consensus is that comparing moves to engine recommendations and using statistical analysis is central, with timing and consistency heuristics as supplements.
- Historical anecdotes recall early web-era client monitoring tricks, now largely obsolete.