Hintru ENES ← Todos los labs

MesaNet Portal — Rail Broadcasts

EN hard CTF challenge Stored XSSXSS botCSRFconfused deputyinnerHTML sinkheadless browsersession hijackAPI abuse

The MesaNet Portal hosts a "Rail Broadcasts" application accessible through a JSON gateway API. A low-privilege operator account can interact with several broadcast endpoints, but a confidential note owned by a privileged automated user sits just out of reach. The challenge requires chaining the broadcast creation pipeline with the automated oversight system to escalate access without ever touching the privileged session directly.

0/8
resueltos
Paso 1 Paso 2 Paso 3 Paso 4 Paso 5 Paso 6 Paso 7 Paso 8
web

Paso 4 · Confirm the HTML injection sink in broadcast creation

Objetivo: Create a test broadcast whose `message` field contains HTML markup and verify that the markup is stored verbatim and rendered unescaped when the broadcast is displayed.

Contexto: You know the bot renders broadcast HTML via `innerHTML`. Now confirm that the `message` field in `/api/rail/create` is the injection point — that whatever HTML you put there survives server-side storage and appears unescaped in the rendered output. Start with a harmless proof like an `<img>` or `<b>` tag before attempting script execution.

Pistas progresivas

Revela solo las que necesites. Claude lleva la cuenta de cuántas usaste para calibrar la retroalimentación.

Pista 1 — empujón direccional

Create a broadcast via the gateway with a simple HTML tag in the `message` field (e.g. `<b>test</b>`). Then fetch that broadcast through `/api/rail/current` or visit `/apps/rail?view=current` in your browser. Does the bold tag render, or is it escaped?

Pista 2 — técnica / clase de vuln

The server interpolates `${message}` directly into the broadcast HTML template without sanitisation. The client-side code then assigns the result to `element.innerHTML`. This is a stored XSS sink — HTML tags in `message` are rendered live in any browser that views the broadcast.

Pista 3 — casi la solución

Try `message: "<img src=x onerror=alert(1)>"` with `type: "safety"`, `priority: "high"`, and any timestamp. Send it, then navigate to `/apps/rail?view=current` in your proxied browser. Note: `<script>` tags are stripped by the HTML parser when injected via `innerHTML`, but event-handler attributes on other tags are NOT stripped.

Tu intento