webhard
Mirror Temple
dicectf_2026
Task: Spring Boot web app with Puppeteer admin bot; steal flag from httpOnly JWT cookie. Solution: Two-stage XSS via proxy CSP bypass - Charon proxy serves content without CSP, use httpbin base64 endpoint to host XSS payload on same origin.
$ ls tags/ techniques/
proxy_csp_bypasstwo_stage_xsssame_origin_html_injection_via_proxyhttpbin_base64_html_hostingcookie_exfiltration_via_image_beacon
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub, then upgrade to Pro.
$ssh [email protected]