webPromedium
Recruiter
duckerz
Task: Resume submission site with reflected XSS and Telegram bot that visits submitted links. Solution: Exploit XSS to make HR bot fetch protected endpoint and exfiltrate flag via webhook.
$ ls tags/ techniques/
reflected_xssadmin_bot_patterncsrf_via_xsswebhook_exfiltration
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]RiceMatch— duckerz
- [web][Pro]board_of_secrets— miptctf
- [web][Pro]112 - Умный переулок (Smart Alley)— duckerz
- [web][Pro]110 - Retro Search (Ретро поиск) - duckerz CTF— duckerz
- [web][Pro]Сила воли (Willpower)— duckerz