Official Stylish Discussion

HTB Content Challenges
1

Official discussion thread for Stylish. Please do not post any spoilers or big hints.

3

Nice challenge. Read the code meticulously. You’ll figure out

4

Anyone got any hints?

6

I got to the injection but can’t UNION after LIMIT… any hints?

7

oh… never mind… I got it… I will have to write a small code to make it more elegant… nice kek

8

Hi, need a hint please…

9

Hint 1:

app.use(function(req, res, next) {
	res.setHeader("Content-Security-Policy", "default-src 'self'; object-src 'none'; img-src 'self'; style-src 'self'; font-src 'self' *;")
    next();
});

Hint 2:

	async getSubmissionComments(submissionID, pagination=10) {
		return new Promise(async (resolve, reject) => {
			try {
                const stmt = `SELECT content FROM comments WHERE id_submission = ${submissionID} LIMIT ${pagination}`;
                resolve(await this.db.all(stmt));
			} catch(e) {
				reject(e);
			}
		});
	}

image
image696×321 76.3 KB

2 Likes
10

i got approvalToken but i cannot execute a successfully approval with token i’ve generated for my id

12

Finally understood pwned thanks

13

Im stuck here, any hints?

14

Hey can you drop another hint for me.The hint 1 provided by you was very helpful but still I am not able to figure out the exact injection payload.
I tried lot of css injection techniques, but i am unable to get the approval token.

15

how can we send Out-of-Band while only font-src ‘self’ * can use? img and style-src both self :<<

16

For the injection. What if you can’t get any strings? Maybe you can get some number…
As long as you have 255 comments or more… you can represent any ascii char using numbers…

17

i can steal all char in the token but i dont know the order :<<

1 Like
18

look at the token generation algorithm… I am sure you will sort it out…

19

yeh, i can steal the token but 2 days i try to bypass it const isAdmin = req => ((req.ip == ‘127.0.0.1’) ? 1 : 0);
It was taken me a lot of time. I still dont bypass ssrf here :<<. smb help me

20

been going to school on this one what works there does not seem to work here. it seems i can steal all but what need, tells me i m missing class and forgot my id.

having to code has made it even more frustrating as it lets you test what you can do after you have the token.

21

maybe you could trigger the approval using the same trick you used to find the token…

22

sometimes just posting helps you figure out how to see what you could not see…

23

■■■, that sooooo coool