niedziela, 21 września 2014

CSAW CTF Web300 writeup

In this post I want to show my solution for CSAW CTF - Web300. This is the service, where we are able to post some links, that are parsed by bot, and looks like this:



There are two important things about this task. First of all, we can notice that page using jquery 1.6.1 (which prone to XSS - CVE-2011-4969) - and serving this kind of code:

The other thing is that bot is based on PhantomJS, so there's a chance, that it interprete javascript on page just like normal browser. ;)

My first shot after connecting those two facts was to exploit XSS on bot, and steal the cookies. It was correct and gave me a flag - these_browser_bots_are_annoying :-)




Pretty simple. doesn't it? :)

26 komentarzy:

  1. we can notice that page using jquery 1.6.1

    OdpowiedzUsuń
  2. We are an online and retail dealer and distribution center based in USA. We specialize in providing quality firearms and accessories to registered buyers

    beretta px4 storm for sale

    sig sauer p938 for sale

    glock 30 for sale

    beretta for sale

    OdpowiedzUsuń
  3. A befuddling web diary I visit this blog, it's incredibly grand. Strangely, in this present blog's substance made motivation behind fact and sensible. The substance of information is instructive
    ابی

    معین

    OdpowiedzUsuń
  4. Wow! Excellent Post. I really found this so much informatics. It is what I was searching for I would like to suggest you that please keep sharing Such type of information. Thank you so much.
    Buy psychedelics online

    OdpowiedzUsuń
  5. I think many of those who read this are asked a lot of online tests or exams, just like me. And I decided to fight this, because doing everything myself quickly gets boring. I started looking for a person who would take my online class. Of all the options that I found, this site turned out to be the best. On it, I was able to quickly agree on everything and send my tasks. The next day everything was ready and everything was done very well. I definitely advise you!

    OdpowiedzUsuń
  6. trusted bitcoin investment sites alphabitmining.com
    how to invest in bitcoin and make money alphabitmining.com
    cryptocurrency trading for beginners alphabitmining.com
    best bitcoin trading platform alphabitmining.com
    how to invest in cryptocurrency alphabitmining.com
    best crypto trading platform india alphabitmining.com
    best crypto trading platform reddit alphabitmining.com
    how to invest in bitcoin and make money if i invest $100 in bitcoin today 2021 alphabitmining.com
    how to invest in bitcoin in stock market alphabitmining.com
    how to invest in bitcoin for beginners alphabitmining.com
    minimum bitcoin investment alphabitmining.com
    bitcoin investment sites alphabitmining.com
    how to buy bitcoins with cash alphabitmining.com
    how to invest in bitcoin uk alphabitmining.com
    how to buy bitcoin online alphabitmining.com
    How can I invest in Bitcoin? alphabitmining.com
    What are the benefits of investing in Bitcoin? alphabitmining.com
    Is it worth investing in bitcoin in 2022? alphabitmining.com
    What is the minimum amount to invest in Bitcoin? alphabitmining.com

    OdpowiedzUsuń
  7. เกมเป็นสื่อสังคมที่จะช่วยฝึกทักษะของผู้เล่น หรือเป็นที่สำหรับเเก้เครียด เกมก็มีมากมายหลากหลายเเนว อีกหนึ่งเเนวเกมที่น่าเล่น เเละจะช่วยฝึกทักษะของผู้เล่นนั้นก็คือ เกมแต่งบ้าน เป็นอีกหนึ่งเเนวเกมที่น่าสนใจ เเละเหล่าเกมเมอร์ไม่ควรพลาดด้วยประการทั้งปวง.

    OdpowiedzUsuń
  8. Great idea thanks keep it up all the time. I am very happy to see your standard. Download GBWhatsapp APK

    OdpowiedzUsuń
  9. Buy Etumax Royal Honey .

    https://royalhoneysupplier.com

    We are a distributing store of Malaysian and Turkish Honey products

    https://royalhoneysupplier.com/product/backwoods-cigars/

    https://royalhoneysupplier.com/product/secret-bio-herbs-energy-coffee-for-women/

    https://royalhoneysupplier.com/product/bio-herbs-royal-king-honey-one-box-10-sachets-of-30g/

    https://royalhoneysupplier.com/product/black-horse-royal-honey-vip-one-box-12-sachets-of-10g/

    https://royalhoneysupplier.com/product/black-horse-vital-honey-one-box-24-sachets-of-10g/

    https://royalhoneysupplier.com/product/cougar-plus-honey-legend-individually-packed-6-sachets/

    https://royalhoneysupplier.com/product/cougar-honey-legend/

    https://royalhoneysupplier.com/product/cougar-honey-legend-vip/

    https://royalhoneysupplier.com/product/cougar-plus-honey-legend-individually-packed-12-sachets/

    https://royalhoneysupplier.com/product/cougar-secret-honey-vip/

    https://royalhoneysupplier.com/product/dose-vital-honey-one-box-12-sachets-of-15g/

    https://royalhoneysupplier.com/product/dose-vital-honey-box-12-sachets-15-g-each/

    https://royalhoneysupplier.com/product/golden-leopard-miracle-honey/

    https://royalhoneysupplier.com/product/helmis-royal-honey-vip-original-from-malaysia-one-box-24-sachets-of-10g/

    https://royalhoneysupplier.com/product/honeygizer-royal-honey/

    https://royalhoneysupplier.com/product/kingdom-ultimate-honey-vip-malaysia-one-box-12-sachets-of-20g/

    https://royalhoneysupplier.com/product/kingdom-ultimate-honey-vip-malaysia-one-box-24-sachets-of-10g-2/

    https://royalhoneysupplier.com/product/kingdom-ultimate-honey-vip-malaysia-one-box-24-sachets-of-10g/

    https://royalhoneysupplier.com/product/kings-candy-coffee-ginseng-12-pcs-x-3-5-grams/

    https://royalhoneysupplier.com/product/kopi-vitamin-energy-coffee-8-sachets-x-20-grams/

    https://royalhoneysupplier.com/product/leopard-miracle-honey/

    https://royalhoneysupplier.com/product/leopard-miracle-honey-classic-1-box-12-sachets/

    https://royalhoneysupplier.com/product/leopard-miracle-of-chocolate/

    https://royalhoneysupplier.com/product/malaysian-royal-honey-vip-one-box-12-sachets-of-10g/

    https://royalhoneysupplier.com/product/malaysian-royal-honey-for-him-one-box-12-sachets-of-20g/

    https://royalhoneysupplier.com/product/malaysian-royal-honey-for-him-one-box-12-sachets-of-20g-2/

    https://royalhoneysupplier.com/product/malaysian-royal-honey-one-box-24-sachets-of-10g/

    https://royalhoneysupplier.com/product/marhaba-royal-honey-one-box-10-sachets-of-20g/

    https://royalhoneysupplier.com/product/medcare-golden-royal-honey-one-box-12-sachets-of-20g/

    https://royalhoneysupplier.com/product/miracle-of-honey-with-herbs-golden-pack/

    https://royalhoneysupplier.com/product/medcare-golden-royal-honey-one-box-24-sachets-of-10g/

    https://royalhoneysupplier.com/product/panther-miracle-of-chocolate/

    https://royalhoneysupplier.com/product/secret-bio-herbs-energy-coffee/

    https://royalhoneysupplier.com/product/secret-miracle-honey/

    https://royalhoneysupplier.com/product/secret-miracle-honey-individually-packed-12-sachets/

    https://royalhoneysupplier.com/product/secret-miracle-honey-for-women/

    https://royalhoneysupplier.com/product/epimedium-honey-herbal-paste/

    https://royalhoneysupplier.com/product/the-ultimate-power-royal-honey-one-box-12-sachets-of-20g/

    https://royalhoneysupplier.com/product/vitamax-doubleshot-energy-honey/

    https://royalhoneysupplier.com/product/themra-ginseng-epimedium-honey-with-macun-12-gr-shots/

    https://royalhoneysupplier.com/product/vip-miracle-of-honey-with-herbs-leather-pack/


    https://royalhoneysupplier.com/product/wonderful-energy-honey-one-box-12-sachets-of-15g/

    https://royalhoneysupplier.com/product/vitamax-doubleshot-energy-coffee/

    We have a ready stock of Leopard Miracle Honey,Royal Honey,Wonderful Honey,Black Horse Honey,VIP Vital ,HoneyBio Herbs and Etumax Royal Honey .

    https://royalhoneysupplier.com

    Whatsapp: +90 531 707 32 56

    Text/ Call / Number: +90 531 707 32 56

    As customers' request for bulk export.

    OdpowiedzUsuń
  10. Buy Drivers License, Passport, Visa, IELTS, ID Cards.

    WE DO ISSUE PASSPORT FOR ALL THE COUNTRIES
    We sell the highest quality SSD chemical solutions and activation powders available
    Shop NOW=========https://documentatiecentrum.com

    WhatsApp : +1 689 247 7384

    OdpowiedzUsuń
  11. NCERT Every year Publishes the 11th Class Syllabus with the Commencement of a Academic Session 2022, Students are Recommended to keep the NCERT 11th Class Revised Syllabus 2022 with them while Preparing for Upcoming NCERT 11th Annual Exam, Students are Recommended to Study the Complete NCERT 11th Curriculum/Syllabus and plan for their Studies Accordingly. NCERT 11th Class Curriculum Syllabus NCERT has Prescribed NCERT 11th Class Syllabus 2022 which are Available for Download free of Cost Online Mode, Students can Download NCERT 11th Class Syllabus can instantly start their studies for the new NCERT Academic Session 20222, Students of NCERT Collages are Recommended to Check other Valuable Resources Available.

    OdpowiedzUsuń
  12. National Council of Educational Research and Training (NCERT) is an autonomous Organisation of the Government of India, NCERT has a Publishing the Study Materials for the Class Students, KVS 1st Class Textbook 2023 This Online Service Offers easy Access to the KVS 1st, 2nd, 3rd, 4th, 5th, 6th, 7th, 8th, 9th, 10th Textbooks 2023. The Service covers Textbooks of all Subjects Published by NCERT for in Hindi, English and Urdu Medium.

    OdpowiedzUsuń
  13. Thanks for sharing this interesting info about that. Please check this: https://apkvow.com/gbwhatsapp/com-gb-whatsapp/

    OdpowiedzUsuń
  14. HPBOSE 11th Previous Paper 2023
    HP Board 11th Class Important Model Question Paper 2023 PDF will be Published on the Official web Portal. Himachal Pradesh 11th Class Important Model Question Paper 2023 and Marking Schemes PDF are Given Below. Important Model Question Paper 2023 are Significant Study Materials in the Exam Preparation Process. HPBOSE 11th Previous Paper 2023 Science, Geography, Sociology, Psychology, and Other Subjects Important Model Question Paper 2023 Details are Provided on This Page. for More Details About the Himachal Pradesh 11th Class Important Model Question Paper 2023 and Important Model Question Paper 2023 Kindly Visit the Official Website.

    OdpowiedzUsuń
  15. The Indian economy comprises 50% unorganized sectors, which hold thousands of workers (families). The sector has daily wagers, unskilled workers, and casual laborers. The groups tend to live from hand to mouth, meaning they don’t consider saving part of their salaries. How to apply for Atal Pension Yojana The greater impact is felt after the active years of working and retirement age knocks in. Most of the families in the sector lead poor life finding it difficult to get proper medication, basic needs, and education.

    OdpowiedzUsuń
  16. Thank you for sharing your expertise with me. Can you verify this information for meEntertainment

    OdpowiedzUsuń
  17. Your contribution has been very helpful. Please review this when you have a chanceTravel & Local

    OdpowiedzUsuń
  18. บริการ สล็อต slot ด้วยระบบเกมใหม่ปัจจุบันของพวกเรา ได้ปรับปรุงแก้ไขให้มีความเสถียรภาพมากยิ่งขึ้น PG SLOT เล่นสล็อตผ่านมือถือ ก็ไม่มีหลุด เล่นได้ทุกระบบปฏิบัติการ จะเล่นโทรศัพท์มือถือเครื่องไหน คอมจำพวกใด

    OdpowiedzUsuń