Very small services.
Beginner Hint 1: About the Admin Bot
- In this challenge, you are given not only the web application itself but also an Admin Bot.
- The Admin Bot has a cookie containing the flag, and it opens a specified path using headless Chrome.
- Therefore, your goal is to make the Admin Bot trigger your payload and send the cookie value to an external server.
- You can prepare your own server as the destination or use an existing service that lets you receive and inspect HTTP requests.
- If you are not yet familiar with how to use the Admin Bot or how to inspect incoming requests, it may help to solve Fushigi Crawler first and read its writeup.
Beginner Hint 2: Approach
- The cookie has the
HttpOnlyflag enabled. This means that even if you succeed in XSS, you cannot leak the cookie usingdocument.cookie. - It looks like there are 3 functions you can choose from via the
funcparameter. Is that all?