Sharing is caring
Beginner Hint: About the Admin Bot
- In this challenge, you are given not only the web application itself, but also an admin bot.
- The admin bot has a cookie containing the flag, and it opens a specified path using Headless Chrome.
- Therefore, your goal is to make the admin bot trigger your payload and send the cookie value to an external server.
- You can prepare your own server as the destination, or use an existing service that lets you receive and inspect HTTP requests.
- If you are still not familiar with how to use the admin bot or how to inspect incoming requests, it may help to first solve Fushigi Crawler and read its writeup.
Beginner Hint: How to approach
scripttags are not filtered, but they do not work in this challenge. When HTML is inserted usinginnerHTML, the browser does not execute anyscripttags in it.- You may want to use event attributes such as
onloadoronerrorto trigger your payload. Can you use them without any whitespace characters?