webhard

Mirror Temple B-Side

dicectf_2026

Task: Steal admin's flag from httpOnly JWT cookie in a Spring Boot app with strict SHA384-only CSP. Solution: Bypass CSP entirely via Charon reverse proxy endpoint that serves content without security headers, enabling same-origin XSS through httpbin base64 HTML hosting.

$ ls tags/ techniques/
jwtxsskotlinreverse_proxyspring_bootcsp_bypasspuppeteertrusted_typescharon_proxyhttpbinsha384_csp
proxy_csp_bypasstwo_stage_xsssame_origin_html_injection_via_proxyhttpbin_base64_html_hostingcookie_exfiltration_via_image_beacon
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]