0

How can I add = in my script when return input.replace (/ [= (] /g, ''); is replacing it? This is only for education purpose solving CTF. Used HTML codes but not working.

  • I’m not entirely sure what you’re asking. What does the script in question do? – securityOrange Dec 3 '18 at 17:14
  • 1
    My guess is try different encodings, octal escape, e.g. String.fromCharCode(075) or \u003d. You could eval the entire code you want to run if you escape when pasting, and unescape during execution. – J.A.K. Dec 3 '18 at 18:21
  • return '<input type="text" value="' + input + '">'; return input.replace(/[=(]/g, ''); used this string <BODY ONLOAD&#61;"prompt&#&40;1)"> In place of <BODY ONLOAD="prompt(1)"> – user192776 Dec 3 '18 at 18:39
  • Yes Tried encoding, Not working... The escape sequence has this code return '<input type="text" value="' + input + '">'; return input.replace(/[=(]/g, ''); used this string <BODY ONLOAD&#61;"prompt&#&40;1)"> In place of <BODY ONLOAD="prompt(1)"> – user192776 Dec 3 '18 at 20:10
4
  = = 

For clarity, that is:

[space][space]=[space]=[space]

The reason this works is because there's only one replace pass running on the input string. In this original string, there's only one instance of "[space]=[space]". When it's removed, there's now a new instance of "[space]=[space]" left over, but replace only scans through the string left-to-right once.

This technique is general to cases where replace is used once to remove a string from another string. Consider the code input.replace(/blue/g, ''). If you gave the string "my favorite color is blblueue", the inner "blue" will be removed, leaving just "my favorite color is blue".

| improve this answer | |
  • Nope It's not working – user192776 Dec 4 '18 at 3:48
  • 1
    @user192776 - 2 things. First of all - if it's not working because of some other issue elsewhere then this answer has addressed the question, so you may need to ask a new question. Secondly - 'not working' is useless on stackexchange, what do you mean 'not working'? Give details. – JᴀʏMᴇᴇ Dec 4 '18 at 9:18
  • In case blblueue we are not giving blue directly anywhere and with [space][space]=[space]=[space], I am giving equals sign direclty as = sign is globally replaced it's replacing even in this scenario. Tried all sort HTML encoding and when = sign is replaced it's not prompting – user192776 Dec 4 '18 at 17:33
  • input.replace (/ [= (] /g, ''); returns ` = ` for the input I gave, so I don't understand your comments. Maybe you didn't post all the relevant code. – Macil Dec 4 '18 at 20:34
  • But it replacing = sign, And those are the only instructions, and <svg> <script>prompt&#40;1);</script></svg> this worked. Thank you everyone for responding – user192776 Dec 5 '18 at 3:02
0

Try HTML encoding with svg tags, After encoding it's not valid javascript. svg renders it text try within svg tags

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.