Challenge

A web app whose source (served at ?src) gated something behind a nonce derived in a loop. Interestingly, the hash algorithm came from a user supplied parameter (lol).

1
2
3
4
5
6
7

for($i=0; $i<8; $i++){
    if(isset($_GET["a"])){
        $n = hash($_GET["a"], $nonce);
        if($n) { $nonce = $n; continue; }
    }
    $nonce = sha1($nonce);
}

Solution

Because $_GET["a"] feeds straight into PHP’s hash($algo, ...), we control the algorithm and can pick a weak/cheap one to make the resulting nonce predictable. From there the path was the usual stored XSS plus a CSRF request to exfiltrate against the now known nonce.