Rustam K

I'm facinated about web technologies and all the ways you can break them

For collaborations: [email protected]

[Rustam K @rumiljonov]

If you manage to solve it with AI - let me know, I'd be curious to see. Had no luck with Kimi K3 and OpenAI Sol.

Here's GLM-5.3 thought process after 15 minutes of trying.

#glm53 #ai #security

[Rustam K @rumiljonov]

If you manage to solve it with AI - let me know, I'd be curious to see. Had no luck with Kimi K3 and OpenAI Sol.

Here's GLM-5.3 thought process after 15 minutes of trying.

#glm53 #ai #security

[Rustam K @rumiljonov]

Try out this new challenge https://t.co/mpwTWL5pK3

Same goal: pop up an alert in the context of the same origin.
The solution is based on how browser processes URLs, which I will talk about later.

GLHF!

#ctf #security #bugbounty #websecurity

[Rustam K @rumiljonov]

Challenge 2: https://t.co/zYiMNUWjRW

The page:
1. Sends the Cross-Origin-Opener-Policy: same-origin header, which blocks the https://t.co/8xP2h3KRIP path
2. The first script iterates over GET parameters to find one that sets the language
3. The second script takes the redirect_to GET parameter
4. If it’s 15 characters or shorter, assigns it to window.location.href

With the https://t.co/8xP2h3KRIP path blocked, let's look at the first script.

The for loop uses var instead of let, so the variable stays in the global scope after the script finishes. That means p holds the last user-supplied GET parameter pair.

With this in mind, we can build the following exploit.

[Rustam K @rumiljonov]

What happens when the browser navigates to a javascript: URL

1. The JS in the URL is executed, duh
2. If the result is not a string → stop
3. Otherwise → replace the current page with a new document whose HTML is that string

https://t.co/PkmEs0pR1M

Now with this knowledge in mind let’s see how the challenges can be solved

[Rustam K @rumiljonov]

Challenge 1: https://t.co/P5VTk7Q6lK

The page contains a script that:
1. Takes the redirect_to GET parameter
2. If it’s 15 characters or shorter, assigns it to window.location.href

The javascript: scheme already takes 11 characters, which leaves only 4 characters for the actual payload.

What can we send in there that returns a string with malicious HTML?

...the name of the window.

This can be set cross-origin (via https://t.co/5RhuEoFl8V) and is accessible as the global name variable.

[Rustam K @rumiljonov]

What actually happens when browser changes location to URL with javascript scheme?

Yes-yes, the browser executes javacript code in the context of the current origin, we all know that.

But what happens next?

Let’s find out - I have 2 challenges I’ve made based on this logic. Just popping up an alert won’t work. Try them out, share your solution with me here or in DMs and I will make another post with the answer soon.

Challenge 1: https://t.co/P5VTk7QEbi
Challenge 2: https://t.co/zYiMNUWjRW

Also visit https://t.co/QIxo78c89z from time to time, I’ll be creating new stuff now and then.

#bugbounty #ctf #pentesting #websecurity #Security

[Rustam K @rumiljonov]

Wrote a small extension to highlight HTTP requests in Burp based on Firefox container they are opened in https://t.co/M2v5egEpQp