Cookie Exfiltration

BDSec CTF 2026’s web track shipped two challenges that sit at opposite ends of the difficulty scale but share the same root failure: the server trusts a client-controlled field to govern a security decision. Admin Portal (50 pts) trusts the alg field inside the client-supplied JWT header to decide which signature algorithm to enforce — the client says alg: none, the server skips signature verification entirely, and a payload with role=admin walks through the front door. Ticketly (425 pts) trusts a client-controlled ticket body after applying a blacklist sanitiser — the sanitiser blocks <script>, <iframe>, <img>, javascript:, and onload, but allows SVG SMIL animation elements including the onbegin event attribute, which executes JavaScript automatically in any browser that renders the page. An admin bot opens the reported ticket, the animation fires, and document.cookie (which holds the flag) is exfiltrated to a webhook in chunked POST bodies. ...

Platform GPN CTF 2026 (kitctf) Difficulty Medium OS Web — Node http, Link header injection, CSS attribute-selector exfil Tags recognising unescape as a percent-decoder that mangles header values, splitting on Link header's comma+semicolon structural separators, injecting a second link entry with rel=stylesheet, hosting the CSS on a serveo-style tunnel that doesn't show an interstitial, iterating body[onload^=prefix] one character at a time Tinyweb is GPN CTF 2026’s pure-web challenge — 481 bytes of one-line Node http server with two reflection points and one admin bot that visits attacker-supplied URLs with the flag in a cookie. The intended path turns out to be an XS-Leaks-style CSS attribute-selector exfiltration: inject rel=stylesheet into the Link header via unescape percent-decoding, host CSS that uses body[onload^="prefix"] selectors to fire background: url(...) requests, iterate one character at a time. ~45 iterations of ~35 seconds each recover: ...