14 lines
661 B
YAML
14 lines
661 B
YAML
slug: elfs_blog
|
|
title: "Elf's Blog"
|
|
description: "Elfs developed a blog to publish insigths from Santa's factory. You found a post called 'Terrible Working Environment' where readers can leave comments. Looks like comments are not serialized. Maybe you can exploit it?"
|
|
category: "web"
|
|
points: 700
|
|
is_visible: true
|
|
complexity: 7
|
|
zip: "local"
|
|
flag_plaintext: "CTF{xss_m4d3_34s13r_w1th_pupp3t33r}"
|
|
hints:
|
|
- text: "Have you heard anything about XSS?"
|
|
penalty_points: 20
|
|
- text: "The server sets a cookie named `session` containing the flag. It's not HttpOnly. Can you craft a comment that reads `document.cookie` and exfiltrates it?"
|
|
penalty_points: 40 |