0

How can I add = in my script when return input.replace (/ [= (] /g, ''); is replacing it? This is only for education purpose solving CTF. Used HTML codes but not working.

  • I’m not entirely sure what you’re asking. What does the script in question do? – securityOrange Dec 3 '18 at 17:14
  • 1
    My guess is try different encodings, octal escape, e.g. String.fromCharCode(075) or \u003d. You could eval the entire code you want to run if you escape when pasting, and unescape during execution. – J.A.K. Dec 3 '18 at 18:21
  • return '<input type="text" value="' + input + '">'; return input.replace(/[=(]/g, ''); used this string <BODY ONLOAD&#61;"prompt&#&40;1)"> In place of <BODY ONLOAD="prompt(1)"> – user192776 Dec 3 '18 at 18:39
  • Yes Tried encoding, Not working... The escape sequence has this code return '<input type="text" value="' + input + '">'; return input.replace(/[=(]/g, ''); used this string <BODY ONLOAD&#61;"prompt&#&40;1)"> In place of <BODY ONLOAD="prompt(1)"> – user192776 Dec 3 '18 at 20:10
4
  = = 

For clarity, that is:

[space][space]=[space]=[space]

The reason this works is because there's only one replace pass running on the input string. In this original string, there's only one instance of "[space]=[space]". When it's removed, there's now a new instance of "[space]=[space]" left over, but replace only scans through the string left-to-right once.

This technique is general to cases where replace is used once to remove a string from another string. Consider the code input.replace(/blue/g, ''). If you gave the string "my favorite color is blblueue", the inner "blue" will be removed, leaving just "my favorite color is blue".

  • Nope It's not working – user192776 Dec 4 '18 at 3:48
  • 1
    @user192776 - 2 things. First of all - if it's not working because of some other issue elsewhere then this answer has addressed the question, so you may need to ask a new question. Secondly - 'not working' is useless on stackexchange, what do you mean 'not working'? Give details. – JᴀʏMᴇᴇ Dec 4 '18 at 9:18
  • In case blblueue we are not giving blue directly anywhere and with [space][space]=[space]=[space], I am giving equals sign direclty as = sign is globally replaced it's replacing even in this scenario. Tried all sort HTML encoding and when = sign is replaced it's not prompting – user192776 Dec 4 '18 at 17:33
  • input.replace (/ [= (] /g, ''); returns ` = ` for the input I gave, so I don't understand your comments. Maybe you didn't post all the relevant code. – Macil Dec 4 '18 at 20:34
  • But it replacing = sign, And those are the only instructions, and <svg> <script>prompt&#40;1);</script></svg> this worked. Thank you everyone for responding – user192776 Dec 5 '18 at 3:02
0

Try HTML encoding with svg tags, After encoding it's not valid javascript. svg renders it text try within svg tags

Not the answer you're looking for? Browse other questions tagged or ask your own question.