2

I participate in a CTF and I had to steal Admin's cookies. And quotes (single and double) were encoded.

I needed to use document.location=URL for steal cookie, but I can't pass URL using quotes.

So I thought I could just create all (document.location=URL) using a base64 and can pass in eval to execute. But problem is base64 decoding

atob(string)

also needs quotes for pass base64 string.

And then I thought I can use int ascii values and then convert into char and then append all to a string. Still problem here because I can't even create a empty string without quotes.

So I don't know if this is possible or not, But can we create a string just using Java Script(Without using of quotes);

Or there was any other way to steal cookie without passing URL in document.location or img tag?

Feel free to edit question.

1

The simplest way to make a string without quotes would be from their char codes:

String.fromCharCode(104,101,108,108,111); // "hello"

If backticks are allowed, you could also use ES6 template strings:

`hello`; // "hello"

Another way might be to assemble the string from other strings in the environment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.