Greetings!
Beginner Hint1: About the Admin Bot
- In this challenge, you are given not only the web application itself, but also an admin bot.
- The admin bot has a cookie containing the flag, and it opens a specified path using Headless Chrome.
- Therefore, your goal is to make the admin bot trigger your payload and send the cookie value to an external server.
- You can prepare your own server as the destination, or use an existing service that lets you receive and inspect HTTP requests.
- If you are still not familiar with how to use the admin bot or how to inspect incoming requests, it may help to first solve Fushigi Crawler and read its writeup.
Beginner Hint2: Approach
- Nonce-based CSP relies on the assumption that the nonce value is unpredictable. Does this assumption hold in this challenge?