webProhard
Board of Secrets Revenge
miptctf
Task: Web app with admin bot where /api/secret is censored by proxy. Solution: Used relative path script injection for XSS, extracted ETag header containing SHA1 hash of original response, brute-forced the flag from the hash.
$ ls tags/ techniques/
sha1file_uploadxssnginxexpressadmin_botheadless_chromeaiohttpproxy_bypassetagrelative_path_injection
relative_path_script_injectionetag_hash_leaksha1_bruteforceresponse_header_exfiltrationproxy_censorship_bypass
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]board_of_secrets— miptctf
- [web][Pro]Lanternfall— neurogrid
- [web][Pro]ASIS Web Mail— ASIS CTF
- [web][Pro]Lab 73 — NetShield — Reflected XSS via 404 Page Attribute Injection— hackadvisor
- [web][Pro]original_task— miptctf