Csrf
- HackChatAI
A CSRF/XSS challenge masquerading as SSTI. A script tag on the admin page exfiltrated the bot cookie. First blood.
- mental-health
A web chain: a controllable hash function weakened the nonce, with XSS and a CSRF exfil on top.
A CSRF/XSS challenge masquerading as SSTI. A script tag on the admin page exfiltrated the bot cookie. First blood.
A web chain: a controllable hash function weakened the nonce, with XSS and a CSRF exfil on top.