small_img.png
NOTE: You don't need to solve Small Image Uploader first.
Beginner Hint 1: About the Admin Bot
- In this challenge, you are given not only the web application itself, but also an admin bot.
- The admin bot has a cookie containing the flag, and it opens a specified path using Headless Chrome.
- Therefore, your goal is to make the admin bot trigger your payload and send the cookie value to an external server.
- You can prepare your own server as the destination, or use an existing service that lets you receive and inspect HTTP requests.
- If you are still not familiar with how to use the admin bot or how to inspect incoming requests, it may help to first solve Fushigi Crawler and read its writeup.
Beginner Hint 2: Approach
- When the admin bot opens
GET /api/file/<file_id>directly, what response header tells the browser how to treat the returned content? The displayed URL or file extension is not what matters at that point. - Not all image formats are binary; some are text-based, and one XML-based image format can contain JavaScript when opened directly in the browser. Which image format is that?