HackThisSite - JavaScript Mission 2

Posted on In Views: Disqus:

Challenge

Disable Javascript. Loading the page immediately kicks you to a fail page; the win link is hidden in the same HTML.

第二关 Disable Javascript：页面加载后立即跳转到失败页，通向通关的链接就在同一份 HTML 里。

Solution

用带登录态的会话取关卡页：

1
2
$ curl -s -b 'HackThisSite=<mission-cookie>' \
    'https://www.hackthissite.org/missions/javascript/2/'

服务端返回的正文里，开头只有一条跳转脚本：

1
2
3
4
<script>
  window.location =
    "http://www.hackthissite.org/missions/javascript/2/fail.php";
</script>

同一份 HTML 的下方藏着一个锚点：

1
2
3
<a href="/missions/javascript/2/index.php?challengePass=<串>"
  >Click here to win.</a
>

抓页面并提交

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
#!/usr/bin/env python3
"""HackThisSite JavaScript 2 ("Disable Javascript").

The level page only runs `window.location = ".../2/fail.php"`; the win link is
hidden in the same HTML.  index.php regenerates the challengePass token on
every load, so fetch and submit must happen back to back in one session:

    usage: HTS_COOKIE=<live-cookie> ./solve.py
"""
import os
import re
import sys
import urllib.parse
import urllib.request

BASE = "https://www.hackthissite.org/missions/javascript/2/"
COOKIE = os.environ.get("HTS_COOKIE", "<mission-cookie>")

def get(url, referer):
    req = urllib.request.Request(url)
    req.add_header("Cookie", "HackThisSite=" + COOKIE)
    req.add_header("Referer", referer)
    with urllib.request.urlopen(req) as rsp:
        return rsp.read().decode("latin-1")

def main():
    page = get(BASE, BASE)
    match = re.search(r'challengePass=([^"&]+)', page)
    if not match:
        sys.exit("no challengePass token in page")
    token = match.group(1)
    print("token:", token)
    win_url = BASE + "index.php?" + urllib.parse.urlencode({"challengePass": token})
    body = get(win_url, BASE)
    print("submitted:", win_url)
    print(body[:200])

if __name__ == "__main__":
    main()

urllib.parse.urlencode 会把串里的 @、%、$、* 这些字符正确转义进查询串。服务端接受的等价 curl 形式是：

1
2
3
4
$ curl -s -b 'HackThisSite=<mission-cookie>' \
    -e 'https://www.hackthissite.org/missions/javascript/2/' \
    -G 'https://www.hackthissite.org/missions/javascript/2/index.php' \
    --data-urlencode 'challengePass=EK@1%I'