> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2022/web-exploitation/noted.md).
# noted
Once we register and log in, we can confronted with this page:
If we click "new note" we can type our note and have it shown back at us.
### Solution
Since our input is reflected, I suspect that this is a XSS Reflection Attack.
If we try to inject a simple HTML XSS Payload, we can see that it works:
```
```
This is called self-xss, and doesn't lead to anything in particularly just yet.
{% hint style="info" %}
**Self-XSS** is when you can only execute XSS in your *own* browser/session — not in someone else's. This happens when the injection point is in data only you can view (your profile, your notes, your settings
**Stored XSS.** Injection point is in shared/public data (a comment section, a username displayed to others, a chat message)
{% endhint %}
We know the payload works because we now see an alert from the payload. However, to figure out the solution we need a look at the source code.
Trying the /new in the url doesn't work as it requires authentication, seems like it's supposed to be something else. We need to relate it back to the clues they gave:
### What is Headless Chrome?
Headless Chrome is basically Chrome running as a robot — used for automated testing, web scraping, and in CTFs, **simulating an admin bot visiting URLs.** The critical difference here is that popup blockers and user-interaction requirements are stripped out, which is exactly what this exploit abuses.
> Puppeteer is a JavaScript library which provides a high-level API to control Chrome or Firefox over the [DevTools Protocol](https://chromedevtools.github.io/devtools-protocol/) or [WebDriver BiDi](https://pptr.dev/webdriver-bidi). Puppeteer runs in the headless (no visible UI) by default
Specifically, we need to exploit "iframes" and "windows.open" First of all let's clarify some definitions.
### What is DOM
The HTML DOM (Document Object Model) is a structured representation of a [web page](https://www.geeksforgeeks.org/websites-apps/web-page-a-complete-overview/) that allows developers to access, modify, and control its content and structure using [JavaScript](https://www.geeksforgeeks.org/javascript/javascript-tutorial/). It powers most dynamic website interactions, enabling features like real-time updates, form validation, and interactive user interfaces.
Imagine your webpage as a tree:
* The document is the root.
* HTML tags like \, \, and \ are branches.
* Attributes, text, and other elements are the leaves.
### What is window\.open()
window\.open(*URL, name, specs, replace*)
Opens a new browser tab/window programmatically from JavaScript. Most popup blockers will block this, but headless chrome won't.
```
// Basic usage
window.open("https://google.com") // opens Google in a new tab
// Named window — this is the key CTF trick
window.open("https://site.com", "pico") // opens site in a tab named "pico"
window.open("", "pico") // returns REFERENCE to existing "pico" tab
window.open("http://site.com/notes", "pico") // doesn't exist yet → opens it
window.open("https://google.com", "pico") // already exists → returns it, IGNORES the url
window.open("", "pico") // already exists → returns it
```
### What is a iframe?
An iframe is an **HTML element that embeds another webpage inside your page** — a page within a page.
``
### Webhook
A webhook is just a **URL that receives HTTP requests and lets you inspect them** — essentially a listener you control on the internet. Also, Webhooks enable interaction between web-based applications using custom callbacks. They allow automatic communication between systems, eliminating the need for one system to constantly check another for updates. Instead, data is pushed automatically whenever an event occurs. Since webhooks work over the internet, all communication happens through HTTP messages. Essentially imagine as a like a website acting as a API.