Sissel Siss3l

Monthly Code Challenge 2025

We have this month some little challenges for the price of one.

<?php

The solution:

The solution:

Should work on the latest version of Firefox and Chromium. Due to recent changes, the --disable-features=EscapeLtGtInAttributes startup flag is required for Chromium, and in Firefox set dom.security.html_serialization_escape_lt_gt=false in about:config (this check should says "does NOT escape");
Should leverage a cross site scripting vulnerability on this domain;

The solution:

The solution:

Based on the website working with NextJS and XML edition, we suspect that related recent exploits are needed to easily solve this challenge:

# On local host
flag = __import__("json").loads(__import__("requests").post(
  "https://hackdonalds.intigriti.io/api/parse-xml",

The solution:

Pop the alert().

Pop an alert.

The solution:

	"""JAN Ten (credit: Darien Brito) \| You can only use TAU in your code, no other number allowed."""
	from flask import Flask, Response, request
	app = Flask(__name__)
	@app.route("/", methods=["GET"])
	def start() -> Response:
	return Response("""
	<!DOCTYPE html>
	<html>
	<head>
	<script src="./p.js"></script>