Reference:https://portswigger.net/blog/exposing-intranets-with-reliable-browser-based-port-scanning …
Prikaži ovu nit
My exploit code for `filemanager` challenge #35c3CTF (just had time to do 1 challenge)
https://gist.github.com/l4wio/3a6e9a7aea5acd7a215cdc8a8558d176 …
It's about XS-Search abusing XSS Auditor.
Thanks @_tsuro for such fun challenge.
-
-
-
@xmira0x86@connorbode Hi, I've just do quick write-up, check the gist again. peaccePrikaži ovu nit
Kraj razgovora
Novi razgovor -
-
-
Clever technique!! Nice and detailed
-
thanks, hope this helps
Kraj razgovora
Novi razgovor -
-
-
All praise goes to
@sirdarckcat who taught me this trick :)Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Where did you find the “a” param?
-
The parameter name doesn't matter. That's just to make chrome think there is a reflected xss on the page (even though there is not).
Kraj razgovora
Novi razgovor -
-
-
Can you publish a full writeup? There are no writeups for this chall (https://ctftime.org/task/7407 )
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Full writeup is much needed for this.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Was "nc 35.246.157.192 1" in chall description kind of misdirection, then? Or there was alternative way to tackle problem?
-
The bot (chrome headless) is running at that address.
Kraj razgovora
Novi razgovor -
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.