10 ms·

stuck on https://govagriculture.web.ctfcompetition.com/ https://govagriculture.web.ctfcompetition.com/ this task, any help?

• ehsankia 7y ago
  Same here. Unless there's some steganography, I'm really all out of ideas. I see see the content of folders (/static/, /static/images/, etc), but that doesn't help. I can't get anything out of /admin and the content of /post don't appear anywhere for any sort of XSS attack.
  • MajorSauce 7y ago
    I completed the challenge. You don't need to see the result of the entry to deduct if XSS is possible. If the server is parsing your input, maybe you can find a way for the server to leak more than it wants. If you want more information, or simply the answer, PM me.
    • m4cie 7y ago
      Hi, could you provide some more information regarding how one can force the server to leak more information than it should? I have been stuck with this exercise for quite some time and am honestly out of ideas.
  • karlding 7y ago
    There isn't any steganography (at least for the flag that I found). They have a bot that actually "reads" your post, which you can verify for yourself. This is alluded to in the message that you get when submitting a post: > Your post was submitted for review. Administator will take a look shortly.
    • ehsankia 7y ago
      > which you can verify for yourself How can you verify? That's what I was stuck, it's hard to test things if you're not getting any sort of feedback. That message seemed pretty constant. EDIT: I see, managed to verify it by putting an image on my own webserver and seeing the log hit. I got a rough idea now, thanks! EDIT2: Got it :)