├── 0ctf_quals-2018
└── h4x0rs.club
│ └── README.md
├── README.md
├── hxp-2018
└── blog
│ └── README.md
└── pwn2win-2019
└── calc
└── README.md
/0ctf_quals-2018/h4x0rs.club/README.md:
--------------------------------------------------------------------------------
1 | # 0CTF 2018: h4x0rs.club - Part II
2 |
3 | **Category:** Web
4 | **Points:** 687
5 | **Solves:** 6
6 | **Description:**
7 |
8 | > Get document.cookie of the admin: https://h4x0rs.club/game/
9 |
10 | **Note:** This is an unintendend solution for the challenge.
11 | ## Write-up
12 |
13 | ### Finding the XSS
14 |
15 | There is a XSS on `/game/javascripts/app.js` in the function responsible for checking if the player won or lost the game.
16 |
17 | ```
18 | function b() {
19 | x(), $(".js-user").append($("#audiences").html()), $(".challenge-out-of-time").show();
20 | [...]
21 | }
22 | ```
23 |
24 | The function above copies the html of an element with id `audiences` to an element with class `js-user` so by creating these elements using the injection on `/game/?msg=` we can achieve javascript execution.
25 |
26 | Then, theoretically, by accessing `https://h4x0rs.club/game/?msg=` and clicking on the play button an alert should pop up after around 15 seconds (the time it takes for the game to end).
27 |
28 | But it doesn't, we are stopped by Chrome's XSS auditor which blocks the access to the page because it detected that a `script` tag on the URL was also reflected into the page.
29 |
30 | We can bypass it by sending `https://h4x0rs.club/game/?msg=` which isn't executed by the browser, but when appended by JQuery through the `append` function, will, surprisingly, ignore the `