Slide 69
Slide 69 text
import express from "express";
const html = `
eval(new URLSearchParams(location.search).get("xss"));
`.trim();
express()
.get("/", (req, res) => res.type("html").send(html))
.all("/*", (req, res) => res.socket.destroy()) // disconnected
.use((err, req, res, next) => {
// revenge!
res.socket.destroy(); // disconnected
})
以上がサーバ側の抜粋。AdminBotは以下。
await page.setCookie({ name: "FLAG", value: FLAG, domain: APP_HOST,
path: "/cookie", // 🍪
});
// 与えられた任意の URLを開く
#
仕様？悪⽤？ ##
AlpacaHack Round 7 (Web) - disconnection-revenge insane