0

I was solving a CTF. Just reading the source code of the web page, I found a vulnerable piece of code:

 var r4c='(.*?)';
 var results = location.hash.match('token\\('+r4c+'\\);');

I am unable to match any string with 'token\\('+r4c+'\\);' with any of my input. Can anyone help me to solve this CTF?

1
  • 2
    Hi and welcome to the site! Could you develop a little and explain why you think thie piece of code is vulnerable and how you think it could be exploited?
    – Anders
    Dec 5, 2022 at 7:49

1 Answer 1

0

It is difficult to say for certain without more context, but this code appears to be potentially vulnerable to a regular expression denial of service (ReDoS) attack. The regular expression 'token\\('+r4c+'\\);' contains an unanchored wildcard (.), which means it can match any character zero or more times.

This can cause the regular expression engine to take a long time to evaluate, especially if the input string is long and complex. An attacker could potentially use this to their advantage by crafting a malicious input string that takes a very long time to evaluate, potentially causing a denial of service on the system running this code.

A small input string that matches the regular expressio could be token(abc);. This input string contains the string token( followed by any number of characters (abc in this case) followed by );, which matches the regular expression.

Here is a JS snippet:

var r4c='(.*?)';
var regex = new RegExp('token\\('+r4c+'\\);');
var input = 'token(abc);';
if (input.match(regex)) {
  console.log('Input matches the regular expression');
} else {
  console.log('Input does not match the regular expression');
}
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.