$ cat writeup.md…

footer

$ cat /about

CTF Base — CTF writeups, searchable with AI.

A searchable library of CTF solutions. grep, don't google.

$ ls /connect

Documentation

MCP Server

$ uptime

online since 2026|ctfbase.com

Lab 277 — InsightPulse — Reflected XSS + Cookie Sandwich (RFC2109 HttpOnly Bypass) | CTF Base

webProhard

Lab 277 — InsightPulse — Reflected XSS + Cookie Sandwich (RFC2109 HttpOnly Bypass)

hackadvisor

Task: InsightPulse reflects a search query as raw HTML and exposes server-parsed cookies through an authenticated tracking API. Solution: execute XSS in the admin bot, create an RFC2109 cookie sandwich around HttpOnly cookies, and exfiltrate the parsed value.

xss admin_bot reflected_xss tomcat httponly rfc2109 cookie_sandwich

reflected_xss_exploitationpath_based_exfiltrationcookie_sandwich_attackhttponly_bypassinternal_origin_bot_submission

$ ls tags/ techniques/

xss admin_bot reflected_xss tomcat httponly rfc2109 cookie_sandwich

reflected_xss_exploitationpath_based_exfiltrationcookie_sandwich_attackhttponly_bypassinternal_origin_bot_submission

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ grep --similar

Similar writeups

[web][Pro]Lab 292 — TeamPulse — CSRF to Stored XSS Chain— hackadvisor
[web][Pro]Lab 231 — PagePulse — XSS via Web Cache Poisoning— hackadvisor
[web][Pro]Lab 283 — PulseMetrics — XSS via HTTP Response Splitting (CRLF Injection)— hackadvisor
[web][Pro]Lab 378 — PulseBoard — Cache Poisoning XSS via Next.js Header Misclassification— hackadvisor
[web][Pro]Lab 321 — MailPulse — Stored XSS via HTML Desanitization— hackadvisor