Beautiful 7

====== TCP1P Multiplication ====== Lessons learned from **TCP1P CTF 2024**: Multiplication [WEB]


', '`', '~', '(' , ')', ',', '+', '-', '/', '*', '%', '^', '|', '&', '!', '?', ':', ';', '.');

        foreach ($forbiddenChars as $char) {
            if (strpos($digit, $char) !== false) {
                http_response_code(403);
                die('403 Forbidden');
            }
        }
    } else {
        $digit = "0";
    }

?>




    
    
    Beautiful 7



    Magical 7

WAF with forbiddenChars is restrictive, JS execution happens directly in:


  var result = multiply(7, );

==== Steps to solve: ==== 1. Utilize document.location.search with a parameter containing an img tag to render JS. 2. Utilize annotation with square brackets e.g. document['body']['innerHTML'] 3. Chain together For example:


1[document['body']['innerHTML']=location['search']]

This will replace the html body. However it will not trigger ,