XSS a Paste Service - Pasteurize (web) Google CTF 2020

Easy web challenge from the Google CTF. XSS a paste service.
John Hammond: • GoogleCTF - Cross-Site...
Gynvael part 1: • #113: Google CTF
Gynvael part 2: • #114: Google CTF
Challenge: capturetheflag...
Pasteurize: pasteurize.web...
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow

[@omerlevy25]

The phrase “little treats” seems to be clear enough of a hint towards cookies. Though I can see how you could get confused and overcomplicate things

[@zuhayr1337]

Ikr, these sort of challenges are almost always about stealing the cookies... No idea how it went upto Recording mic xD Good video as usual anyways

[@CuteLittleHen]

Good catch, my Israeli friend. ;)

[@AviPars]

yA

[@mcbpete]

What do you Pasteurize ? Milk ! What goes with milk ? Cookies !

[@terjanq]

It made my day 😂

[@AtheistReligionIsCancer]

1. No need to use any third parties proxy or that fancy shit, Firefox has all of it built in in network tools. You just need to find the post request in the left of the panel and click it, then clik on header in the right and send again. 2. I got the server to make a 500 by basically copying all of the string, so the cookie was content=content... This is typically an indication there are other vulnerabilities

[@epicm999]

I drink milk with toast and Nutella

[@NickInts]

"Third party might have implanted it" most likely refers to a third party cookie and "little treats" backs up the cookie guess!

[@youdonotknowmyname9663]

"The CTF started at 2AM german time so when I got up at 8AM, somebody from our team has already found the vuln" I love it when I get up and the work is already done! ;-)

[@dematrsinba4361]

It's actually pretty common with XSS to steal cookies, like all my CTFs it's basically that, and that's the first thing i try.

[@DawnnDusk-k4n]

Just gave it a try at 5AM IST. I saw Rabbits running around. Nothing more. Gave up the damn challenge after 2days. Then came John's ting ting notification. Learned a lot!

[@patrickgh3]

Thanks for the concice and informative explanations! I paused a bunch while watching to make sure I understood parts.

[@profiluefter]

I've not played that many CTFs but almost everytime there is an xss, it's about stealing the cookie

[@7he7hief95]

i like your vids very much, especially the extensive explanation of the causes and your enthusiasm. so go on and pwn!

[@bryces8017]

I've seen this type of vuln recently! I got a $200 bounty for it. Usually when testing for this you'll end up with "[Object object]". This lack of type checking is a common issue with nodejs in particular and is often a good place to start when looking for vulnerabilities. I believe adding more than one of the same parameter also works the same way

[@Zsqra_7331]

Dude, this version of CTFPad is genuinely awesome and beautiful. Is there a chance that you and your friends would make it go public?

[@Zedoy]

Yeah I hope so

[@youdonotknowmyname9663]

Yeah, it might be usefull for "organizing" all sorts of things ...

[@akashak00011]

Can we get the updated version of the CTFpad! The repo is pretty much completely outdated :(

[@techstudio2903]

i had seen the solve on john Hammonds channel but this just cleared all my doubts

[@bluemushroom415]

Having this with John hammnd’s vid gives nice alt angle

[@nbsp8902]

Yeah bro i also watched his video

[@nekomandu8622]

pasturising is normaly used in milk products to sanitize. milk and cookies?

[@Veso266]

The most amazing thing in this video is Alles CTFTool? (Would like to have a piece of that :) )

[@Zedoy]

Saaaaame

[@d3line]

Currently writing similar thing for my team, turns out online collaborative environments are pretty hard to write (who knew)

[@bigmistqke]

Looks really insane

[@8iter]

@@d3line I also hacked together a tool for my team for a CTF we just finished. Maybe you could consider using the collaboration tool they used called "codimd", coding it from scratch would be a nightmare 😭

[@d3line]

8iter, Anime Piano Videos thanks for mentioning it! I wasn’t trying to build full-on collaborative editing, but this thing will be a nice addition;)

[@RonFarkash]

that's a very cool challenge and a nice solution, I learnt a lot from it, thanks.

[@danimunf]

damn what 11 minutes of confusing yet interesting for such a n00b like me. I really love ctf but never had one and still learning

[@ameisee4]

Where can one find your version of CTFPad? Could you link it in the description maybe? Thanks :)

[@infohacking]

Love your video ...plz make more on Google CTF ❤️❤️❤️ learning a lot from you🙏🎉🎉

[@deathfromthekrypt]

That is amazing

[@secureitmania]

Your way of presentation gives the dopamine kik. Thank you

[@anzeblagus9513]

Just a question: Why use burp instead of the built in networking tab? There must be a reason, I just don't know it...

[@samfoxman7046]

You can modify requests and responses live, and you can easily resend requests with modifications. Also, it works across all tabs

[@MakerTim]

changing the request before sending it to the server so in this video he changed a content=... to content[x]=... made it much faster then go to networking copy the cmd/bash command and change it over there

[@anzeblagus9513]

@@MakerTim I mean is it really faster? I just copy as fetch and modify it...

[@matzibeater]

In this case it doesn't really make a difference, because he only used the repeater function and only changed small parts in an already small request. But Burp has a lot more to offer and if you're unsure how big of a task you're looking at, it's at least not a bad habit to default to using it. In this video he's simply non-invasively querying an API, that's totally doable with just the browser's dev tools, that's true. For really small tasks that only need a handful of requests I'd do that too, but sometimes stuff takes longer than planned and copy-pasting gets tedious after a while and you start regretting not using a tool in the first place.

[@anzeblagus9513]

@@matzibeater Yea, that makes sense. Never done any "bigger" vulnerability testing, thanks for the info!

[@thegrandpew3921]

You should do the 2nd pasteurize all the little things. It was a good challange and actually had many ways to solve

[@tourpran]

As always neat and super cool !

[@jessienewman3879]

I understood 0 words in the title but got the impression it was something to do with coding so here I am

[@Speedfight246]

There was a hint with the treat ;)

[@gpenner]

He mentioned it's best to sanitize xss client side, does that mean we don't need to do it server side or we should do both?

[@malonxos6069]

I watched hammonds video, but didnt get anything. I did it with you, thanks for the video

[@shutterbugsid1467]

Hey, can you make video on CPENT 2020 vs OSCP 2020 What would be the better course? EC Council is giving BIG Claim, like "THE BEST PENTESTING COURSE" in the WORLD, does it stand to what the company claims to be or Bluff....

[@falhtuuu]

Bro if I want to learn all languages like c++,java etc so from where I study them is KZbin good for that plz help

[@ala_b2017]

The payloads u tried before the right one are cool

[@CyReVolt]

nice subtile credits given 😁 thank you!

[@arisweedler4703]

Does cherryworm have any plans to open source that CTF tool? Looks awesome :D Would love to learn how it works and add to it. The engine of this app could create a server for any team to just log into and have one of these running. If tournament organizers used this, then there would be all sorts of benefits. (Do you have to manually input your team members into this tool?)

[@arisweedler4703]

Oh wow after 3 minutes of the John Hammond linked video provided, I think I understand why frontend sanitization is good enough sometimes? This XSS attack basically only allows a client to attack his own computer. And any frontend sanitizer will allow that, but we don't care, cuz that's not an attack vector to anyone, really.

[@atomspalter2090]

nice video!

[@shubham399]

I think the server code also contained the hint to look at the cookie for the flag.

[@krlst.5977]

"Better to do sanitization in the browser on the client and not on the backend" - could you please explain this? It is really unintuitive and against my thoughts :-)

[@Demonslay335]

I think it has to do with the fact web server languages are not "designed to understand HTML" as a browser does, so it's more likely to miss something. Something along those lines IIRC.

[@krlst.5977]

@@Demonslay335 but after all it is possible to get to the server bypassing the user interface and then all sense of sanitizing on it is absent and there is a necessity of sanitizing on the server

[@Demonslay335]

@@krlst.5977 Aha, he actually did cover this topic last year, rewatching again myself: kzbin.info/www/bejne/oniahmacqrOqaaM

[@AtheistReligionIsCancer]

There are good tech talks on it from black hat. I think they call it polymorphic XSS or DOM based XXS or something like that.

[@AtheistReligionIsCancer]

@@krlst.5977 It's only necessary if you want to allow HTML in a post. If you do not allow any fancy shit, then the standard serverside encoding before output is enough. The problem though is, that many services now want to allow users to add both CSS and HTML to a post. That's when it gets dangerous because there are different executiuon contexts in the same piece of code, which needs different kinds of escaping. When you lock everything down then there is only one execution context, which is HTML and you can HTML encode the special chars on output that's enough.

[@HyderAli-hl8mw]

Great work bro

[@IsAMank]

that new embedded chrome browser on burp is wonderful, no more forgetting to turn foxyproxy on!

[@anonymouswr3817]

We need a Series on Google CTF 2020

[@abdarafi]

This is cool chall!

[@iWhacko]

"Third Parties might have implanted it with THEIR little treats", little treats meaning cookies, so Third party cookies?

[@Yaxqb]

4:30 cant you just use the network tab in chrome devtools?

[@Anonymous-vh6kp]

Yes, but cannot modify the request I don't think

[@hamster6093]

why cookie request mode is set to no-cors

[@KaleshwarVhKaleshwarVh]

I have seen John Hammond's video, let's see your now.

[@bagofwheat5713]

what is your main job?? its not youtube right??

[@tonkotsu_noodles]

Can we get the cookie using burp collaborator instead of using hookbin ? If the challenge is still up i would definitely try it out...but if someone knows pls let me know !

[@xJoaoGx]

Is it a dejavu?

[@simonfarre4907]

I would certainly like some more explanation as to why sanitization is better done on the client side. That intuitively sounds so far from the truth I can't begin to explain it even. Also, if allowing some tags are allowed, why wouldn't a white list, handled by the server be a much, much, much, much better and safer alternative?

[@LiveOverflow]

Because the browser will understand HTML differently than the server. If there is a difference, it can be exploited. Each browser might have small differences. How would the server know which differences there are?

[@simonfarre4907]

@@LiveOverflow great question. I will have to ponder about this some more. But just intuitively, and first impression thought, it seems to me this kind of thing would be solved better on the server side, as if a request or package of data as it were, could be actually stripped of its non safe content on the server side entirely, and responded with only valid or white listed content, static HTML. Or what am I missing here? Because it seems to me, the insecurities lie squarely within the javascript domain and its inherent type-unsafety. And seeing as we have websockets today, data could be as dynamic as we ever could get it with javascript, but the server would act as some form of compiler receiving source code essentially and responding with the compiled data, ie HTML only, and having javascript only existing only as a very, very thin layer on the client side. Which is completely contrary to how webdevelopment works today.

[@LiveOverflow]

Checkout the Google XSS video. Iirc I talk about this topic a bit more there

[@SimonHuenecke]

But Cookies are the first thing to attack when sending a privileged user a XXS payload, because that's usually how the server knows who you are. Or am I wrong?

[@Quantiom]

I'm surprised that you guys didn't try the cookie first

[@justanormalperson]

nice

[@beron_the_colossus]

Nice!

[@bollvigblack]

you have so much money, im happy for you ^^

[@LiveOverflow]

wat

[@arisweedler4703]

DOMPurify could never be used in security-critical applications, right? You 100% have to also sanitize on the backend if you don't want an attacker getting a victory like this. I barely understand the benefit of a frontend sanitizer - unless you're more likely to be compromised by a random input of a user than a targeted input of an attacker. Which... seems ridiculous... but may actually be true for some companies? If they're small enough. But if they use something like this, seems like they'll have to stay a small company or change it. Regardless, I don't even understand why frontend sanitizers are good! Why are they more useful? Strain on the backend server is too much? Like too many requests would basically ddos any backend server if and only if the backend server was running a sanitizer?

[@arisweedler4703]

I spoke too soon, this is complicated. Still not sure why a frontend parser is good though! But now I know I need to learn why, instead of learn why people use them xD

[@arisweedler4703]

I love that - The TJMike button, what I thought was the "check if you got the right attack to get the information" was really the feature y'all were attacking. Meta.

[@arisweedler4703]

I wanna know SO bad! Why is it better to do sanitization on the frontend??

[@arisweedler4703]

I have a problem with 8:01 - the server didn't expect a string it expected a sanitized string! Unless this was a real bug... (Which makes this video even COOLER than it already is)

[@LiveOverflow]

There is a difference between sanitizing HTML and escaping any input. So if you simply want to have TEXT placed into the website, then yes, do the escaping before you place the content into the page. So this can be done in the backend (when your site renders the sites on the backend, for example in php). Or if you have something like REACT, then REACT will escape the text before rendering the page on the client. But if you are trying to have safe HTML (for example you want to allow , or allow but without event handlers like onerror), then you open a can of worms which I briefly mentioned here. But also go checkout my Google Search XSS video which goes into it a bit more. Every browser interprets HTML maybe slightly differently, so the backend cannot know how exactly the browser will interpret it. DOMPurify now uses the browser to render the HTML but without executing any javascript. This is an amazing trick, because now DOMPurify sees the HTML exactly how the browser parses the HTML. And then DOMPurify can go over it and remove any javascript. Thus it is better to do it in the client - because the backend could never exactly understand HTML how the browser does it.

[@sinecurve9999]

Instructions unclear. Eyes now pasted.

[@BlackHermit]

ALLES!

[@amisraelichai296]

🤯‼️

[@blobthekat]

i solved this in about an hour but using arrays instead

[@theyhatelos]

early for first time

[@rafaelpereiradias2567]

They have wrote a cookin in the ctf page.

[@yoda6076]

Yes, it's very "easy".

[@arijeetmondal8494]

Upload videos on AllesCTF walkthrough

[@tisla142]

Sir give any website for earning

[@SmilerRyanYT]

Huh, so my problem was I didn't realise that asking the send button actually sent the code to be viewed rather than only redirect with the ?msg=

[@Teshi39]

I just made the 70th comment it's no longer 69

[@lusiaa_]

I've never been so early

[@panel2844]

Happy Cirno day! 🇵🇱

[@lusiaa_]

@@panel2844 thanks! ⑨

[@DanEcomX]

noice

[@anonymosranger4759]

Grüße von Heidelberg

[@usertempeuqwer7576]

i got your video on 'CTFs are terrible' on my recommended after watching this, LOL ?

[@zekiz774]

He also did a video: "CTF's are awesome"

[@MatthieuCoder]

Me too!

[@MrLennonson]

Urghh this sounds so fun, but I can't understand anything...

[@svampebob007]

"easy" 😃 I also thinks it sounds fun and very interesting to find such exploits/holes, but I have no idea who they get the idea to get Cookies, get the microphone, my clipboard.... I host a couple of services on my server that are open to the public and I'm super paranoid that I'm doing something obviously stupid in terms of security, but I my "programming" skills are far beyond the scope of finig out bugs and exploits like that, basically I just blindly trust that the people making the software are competent and that I do not mess up the settings/implementations too much :) I try to keep most of my exposure down to simple ssh type of exposure, but I've tried my luck with php and Sqrl and honestly I just hope that the collection of copy pasted "tutorials" that I've edited together to fidtmy use aren't a big old light house of easy bounty for hackers :)

[@sayemprodhanananta144]

Third party cookie

[@ankitankit-bo4by]

First, from India.

[@cold_ultra]

We are so proud of you

[@ankitankit-bo4by]

@@cold_ultra thanks ❤️

[@user-zu6ts5fb6g]

Nice, well done. I hope to beat you next time, i am not from India though. Do i still qualify for this challenge?

[@dummypg6129]

Hello

[@overlisted]

urize (urine)

[@GabrielTobing]

Third party cookies. I hate those.

[@thomapple]

Using BeEF would have probably helped, it has a lot of payloads to try to extract secrets