Personal Blog

uoftctf2026

Task: Node.js blog app with DOMPurify-sanitized post saving, an unsanitized autosave endpoint, magic link auth, and non-httpOnly cookies visited by an admin bot. Solution: Injected stored XSS via the unsanitized /api/autosave, used magic link to capture the admin's session in sid_prev cookie, then performed a cookie swap attack to fetch /flag as admin and save it to the attacker's post.