XSS via ES6 Reflect API - Solution to May '23 Challenge

Опубликовано: 30 Май 2023
на канале: Intigriti

1,618

🏆 The official writeup for the May '23 Challenge, featuring XSS and WAF bypass, using the Reflect API from ECMAScript 6 😎

Follow Renwa: / renwax23
Solve the challenge: https://challenge-0523.intigriti.io

🧑💻 Sign up and start hacking right now - https://go.intigriti.com/register

🐱💻 Can't get enough of these challenges? - https://blog.intigriti.com/hackademy/...

👾 Join our Discord - https://go.intigriti.com/discord

🎙️ This show is hosted by / _cryptocat ( ‪@_CryptoCat‬ ) & / intigriti

👕 Do you want some Intigriti Swag? Check out https://swag.intigriti.com

00:00 Intro
01:00 Explore site functionality
01:24 Review input restrictions (WAF)
02:54 ECMAScript6 Reflect API
04:31 Develop payload
06:44 Pop an alert(document.domain)
07:20 Arbitrary XSS
09:20 Conclusion